VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/traefik/traefik/v3: vulnerability history, versions and safety

github.com/traefik/traefik/v3 is a package in the Go ecosystem. Vulert records 31 vulnerabilities for it across 120 releases, from Apr 2024 to Sep 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
31 vulnerabilities recorded C2 H13 M14 L2
i
1 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
25 in the last 12 months

Most recent disclosure 10 Sep 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/traefik/traefik/v3 vulnerabilities

Vulert verdict on github.com/traefik/traefik/v3 v3.7.16 i

Updated on 23 Oct 2026

Action needed: v3.7.16 has 9 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 67/100
  • Security Unfixed issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Moderate

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v3.7.16 — affected i
  • Vulnerabilities on record 31 over 2 years · 25 in the last year i
  • Latest disclosure 10 Sep 2026 i
  • Highest CVSS 9.1 i
  • With no published fix 1 i
  • Stars 65,294 i
  • OpenSSF scorecard 5/10 i
  • Last release this month i
  • Licence MIT i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/traefik/traefik/v3, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v3.7.17-0.20261022140808-9f1c3614d9f7 22 Oct 2026 H2 M6 L1 MIT Yes Details →
v3.7.17-0.20261022075338-ee3b69d18403 22 Oct 2026 H2 M6 L1 MIT Yes Details →
v3.7.16-0.20261020090035-a804fea41db3 20 Oct 2026 H2 M6 L1 MIT Yes Details →
v3.7.17-0.20261020090035-a804fea41db3 20 Oct 2026 H2 M6 L1 MIT Yes Details →
v3.7.16 20 Oct 2026 H2 M6 L1 MIT Yes Details →
v3.7.16-0.20261020084406-af6d927c5119 20 Oct 2026 H2 M6 L1 MIT Yes Details →
v3.7.16-0.20261015124206-ba13324b2ed7 15 Oct 2026 H2 M6 L1 MIT Yes Details →
v3.7.15-0.20261015091020-62b1f935f761 15 Oct 2026 H2 M6 L1 MIT Yes Details →
v3.7.16-0.20261015091020-62b1f935f761 15 Oct 2026 H2 M6 L1 MIT Yes Details →
v3.7.15 15 Oct 2026 H2 M6 L1 MIT Yes Details →
v3.7.15-0.20261015090206-351a5ab1e884 15 Oct 2026 H2 M6 L1 MIT Yes Details →
v3.7.15-0.20261013065616-f2f3481f6804 13 Oct 2026 H2 M6 L1 MIT Yes Details →
v3.7.15-0.20261012135407-816d040658c2 12 Oct 2026 H2 M6 L1 MIT Yes Details →
v3.7.15-0.20261008074525-6e722fee4ed4 08 Oct 2026 H2 M6 L1 MIT Yes Details →
v3.7.15-0.20261006073055-bb4bdd60cf31 06 Oct 2026 H2 M6 L1 MIT Yes Details →
v3.7.14-0.20261005131006-c0eb9530f49e 05 Oct 2026 H2 M6 L1 MIT Yes Details →
v3.7.14 05 Oct 2026 H2 M6 L1 MIT Yes Details →
v3.7.14-0.20261005094006-3bd7aa32e1b6 05 Oct 2026 H2 M6 L1 MIT Yes Details →
v3.7.14-0.20261002071205-cad11c64cc70 02 Oct 2026 H2 M6 L1 MIT Yes Details →
v3.7.14-0.20260929142355-fcbfb8aff229 29 Sep 2026 H2 M6 L1 MIT Yes Details →
v3.7.14-0.20260928130407-f08328cb2c5f 28 Sep 2026 H2 M6 L1 MIT Yes Details →
v3.7.14-0.20260928095009-3d6046d11f6b 28 Sep 2026 H2 M6 L1 MIT Yes Details →
v3.7.14-0.20260925123406-f08964179357 25 Sep 2026 H2 M6 L1 MIT Yes Details →
v3.7.14-0.20260923130835-34ea85d945c3 23 Sep 2026 H2 M6 L1 MIT Yes Details →
v3.7.14-0.20260922122638-cb4e823598ad 22 Sep 2026 H2 M6 L1 MIT Yes Details →
v3.7.14-0.20260914100208-e75250a31ae7 14 Sep 2026 H2 M6 L1 MIT Yes Details →
v3.7.14-0.20260911134206-903e8a965795 11 Sep 2026 H2 M6 L1 MIT Yes Details →
v3.7.14-0.20260904092544-d48621ce0b6f 04 Sep 2026 H2 M6 L1 MIT Yes Details →
v3.7.13 04 Sep 2026 H2 M6 L1 MIT Yes Details →
v3.7.13-0.20260904084805-fc92cc118a05 04 Sep 2026 H2 M6 L1 MIT Yes Details →
v3.7.13-0.20260831082406-ac3fab514d8a 31 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.13-0.20260831075805-33411fd1d500 31 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.13-0.20260830090006-81f4e3cd718c 30 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.13-0.20260828161405-43bc3aff61a8 28 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.13-0.20260828153006-ec3084ce00ab 28 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.13-0.20260828151406-b2f6bca47cdc 28 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.13-0.20260828135206-237f13c677ed 28 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.13-0.20260827145206-c84f39da7f72 27 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.13-0.20260827132605-8702556d3edd 27 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.13-0.20260826082401-83c3499fc31c 26 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.12 26 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.12-0.20260826081606-e8f398ee30ca 26 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.12-0.20260826074920-3670c2343c48 26 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.12-0.20260826072606-cacbb72aa6ab 26 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.12-0.20260825153006-38b584d6b644 25 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.12-0.20260825082217-1cddc653692f 25 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.12-0.20260824135806-b30a12d0d45b 24 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.12-0.20260824133608-2d4bec359ee2 24 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.12-0.20260824132207-4f35900e0409 24 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.12-0.20260824131208-e0b53f526da1 24 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.12-0.20260824121207-d5072ce7b876 24 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.12-0.20260824085929-2114f0b5b0f4 24 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.12-0.20260824082606-f2d0794417e4 24 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.12-0.20260821140009-473e27980fe4 21 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.12-0.20260820150408-9bb0e55e8661 20 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.12-0.20260820142006-b78307590625 20 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.12-0.20260820131806-edb665cee6bb 20 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.12-0.20260820094206-805a52d2f95a 20 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.12-0.20260818134900-6fc09bbb36e0 18 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.11 18 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.11-0.20260818134406-faa1eb590646 18 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.11-0.20260818131613-4d98b4dc68f6 18 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.11-0.20260818073406-90ecf6930012 18 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.11-0.20260818070007-6dd14ce0ac34 18 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.11-0.20260817130806-f762508e1763 17 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.11-0.20260817123806-8314b5526195 17 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.11-0.20260811125140-b51bd71e1f79 11 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.11-0.20260811124606-21a4ca1fad46 11 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.11-0.20260811123406-399a52e6d8f0 11 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.11-0.20260811101055-385b9d7746cd 11 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.6.26-0.20260811094605-2ec320bcc7f3 11 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.11-0.20260811074406-915aa2d33518 11 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.11-0.20260810161006-8bd3bd277758 10 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.11-0.20260810084805-078b8b95265f 10 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.11-0.20260805133007-ead8b92dba6e 05 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.11-0.20260805125006-82c307b8ace1 05 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.6.26-0.20260804122407-803c597250b4 04 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.11-0.20260804071213-3f3466a3c4a5 04 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.11-0.20260803120605-0258b3a756f9 03 Aug 2026 H2 M6 L1 MIT Yes Details →
v3.7.10-0.20260731094019-dbe7e70f951b 31 Jul 2026 H2 M6 L1 MIT Yes Details →
v3.7.11-0.20260731094019-dbe7e70f951b 31 Jul 2026 H2 M6 L1 MIT Yes Details →
v3.0.0-20260731090405-2a2349356c01 31 Jul 2026 H2 M6 L1 MIT Yes Details →
v3.7.10 31 Jul 2026 H2 M6 L1 MIT Yes Details →
v3.7.10-0.20260731090405-2a2349356c01 31 Jul 2026 H2 M6 L1 MIT Yes Details →
v3.7.10-0.20260731085406-aa95d97bd200 31 Jul 2026 H2 M6 L1 MIT Yes Details →
v3.7.10-0.20260731083446-b1acdef031a7 31 Jul 2026 H2 M6 L1 MIT Yes Details →
v3.6.25 31 Jul 2026 H2 M6 L1 MIT Yes Details →
v3.6.25-0.20260731083405-4b18b24b0b00 31 Jul 2026 H2 M6 L1 MIT Yes Details →
v3.7.10-0.20260730153609-e80aaab074b4 30 Jul 2026 H2 M6 L1 MIT Yes Details →
v3.7.10-0.20260730143307-43dd7e1e03c8 30 Jul 2026 H2 M6 L1 MIT Yes Details →
v3.7.10-0.20260730134807-5cf02a683e4d 30 Jul 2026 H2 M6 L1 MIT Yes Details →
v3.7.10-0.20260730124517-79224ff8a049 30 Jul 2026 H2 M6 L1 MIT Yes Details →
v3.6.25-0.20260729091006-a764166656f0 29 Jul 2026 H2 M6 L1 MIT Yes Details →
v3.6.25-0.20260728131007-b5ace8eb5d67 28 Jul 2026 H2 M6 L1 MIT Yes Details →
v3.7.10-0.20260724083315-fd5a576df2e8 24 Jul 2026 H2 M6 L1 MIT Yes Details →
v3.7.9-0.20260724083315-fd5a576df2e8 24 Jul 2026 H2 M6 L1 MIT Yes Details →
v3.7.9 24 Jul 2026 H2 M6 L1 MIT Yes Details →
v3.7.9-0.20260724083205-d0bd2ec19853 24 Jul 2026 H2 M6 L1 MIT Yes Details →
v3.7.9-0.20260724080947-455ef35cfd09 24 Jul 2026 H2 M6 L1 MIT Yes Details →
v3.6.24 24 Jul 2026 H2 M6 L1 MIT Yes Details →
v3.6.24-0.20260724080805-cc3365818469 24 Jul 2026 H2 M6 L1 — Yes Details →
v3.7.9-0.20260723154152-cab9b3ab7fad 23 Jul 2026 H2 M6 L1 — Yes Details →
v3.7.9-0.20260722145618-aa91c754aca9 22 Jul 2026 H2 M6 L1 — Yes Details →
v3.7.9-0.20260722144812-ce130e21e135 22 Jul 2026 H2 M6 L1 — Yes Details →
v3.7.9-0.20260720142406-d7292bdc8b73 20 Jul 2026 H2 M6 L1 — Yes Details →
v3.7.9-0.20260720094605-030aadc9ccf9 20 Jul 2026 H2 M6 L1 — Yes Details →
v3.0.0-20260715130157-14bc52dd1f1d 15 Jul 2026 H2 M6 L1 — Yes Details →
v3.7.9-0.20260715130157-14bc52dd1f1d 15 Jul 2026 H2 M6 L1 — Yes Details →
v3.7.8 15 Jul 2026 H2 M6 L1 — Yes Details →
v3.7.8-0.20260715123404-4a87f05acfa2 15 Jul 2026 H2 M6 L1 — Yes Details →
v3.7.8-0.20260715115805-4bc7630e9dc0 15 Jul 2026 H2 M6 L1 — Yes Details →
v3.7.8-0.20260715095411-a3588b4555a2 15 Jul 2026 H2 M6 L1 — Yes Details →
v3.7.8-0.20260715094013-bf78dbc58efa 15 Jul 2026 H2 M6 L1 — Yes Details →
v3.7.8-0.20260715084917-8e5dc3273752 15 Jul 2026 H2 M6 L1 — Yes Details →
v3.7.8-0.20260713133605-759515bec1b9 13 Jul 2026 H2 M6 L1 — Yes Details →
v3.7.8-0.20260710080436-90164283504b 10 Jul 2026 H2 M6 L1 — Yes Details →
v3.7.8-0.20260709152547-304bdfe14d03 09 Jul 2026 H2 M6 L1 — Yes Details →
v3.7.8-0.20260709073805-69259c3acc9d 09 Jul 2026 H2 M6 L1 — Yes Details →
v3.7.8-0.20260708153947-b93f02cd07b7 08 Jul 2026 H2 M6 L1 — Yes Details →
v3.7.7 08 Jul 2026 H2 M6 L1 — Yes Details →

The newest 120 of 670 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2024 4
  • 2025 4
  • 2026 23

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 25 of the 31 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/traefik/traefik/v3

The 5 most severe of 31 vulnerabilities recorded for this package

Search all 31 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2026-88007: Traefik HTTP/3 Backend NTLM Connection Reuse Vulnerability 9.1 critical 3.7.13 10 Sep 2026
CVE-2026-88009: Traefik HTTP/1 Request-Target Routing Bypass Vulnerability 8.8 high 3.7.13 10 Sep 2026
CVE-2026-71327: Traefik Gateway API Route Identity Collision Leading to Cross-Namespace Backend Hijacking 8.2 high 3.6.25 06 Aug 2026
CVE-2026-35051: Traefik Authentication Bypass via Spoofed X-Forwarded-Prefix Header 7.8 high 3.7.0-rc.2 24 Apr 2026
CVE-2026-39858: Traefik Authentication Bypass via Forwarded Alias Spoofing 7.8 high 3.7.0-rc.2 24 Apr 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/traefik/traefik/v3

Is github.com/traefik/traefik/v3 safe to use?

Vulert records 31 vulnerabilities for github.com/traefik/traefik/v3 in Go: 2 critical, 13 high, 14 medium and 2 low. 1 of them has no published fix yet, so that is the one to avoid or mitigate.

What is github.com/traefik/traefik/v3's Vulert package health score?

Vulert scores github.com/traefik/traefik/v3 67/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/traefik/traefik/v3 affected?

Yes. v3.7.16, the version you would install today, has 9 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

How many vulnerabilities does github.com/traefik/traefik/v3 have?

31 vulnerabilities are recorded for github.com/traefik/traefik/v3 in the Go ecosystem: 2 critical, 13 high, 14 medium and 2 low. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/traefik/traefik/v3 vulnerabilities disclosed?

25 vulnerabilities were recorded for github.com/traefik/traefik/v3 in the last 12 months, and the oldest entry in this database dates to 12 Apr 2024. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/traefik/traefik/v3 are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/traefik/traefik/v3 for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/traefik/traefik/v3 version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.