Github.com/traefik/traefik/v3
28 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Github.com/traefik/traefik/v3, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Github.com/traefik/traefik/v3 CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 1 |
| 2024-12 | 1 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 3 |
| 2025-05 | 1 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 1 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 2 |
| 2026-01 | 1 |
| 2026-02 | 2 |
| 2026-03 | 6 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 28 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical4
- High6
- Medium8
Latest CVEs
The 15 most recently published vulnerabilities affecting Github.com/traefik/traefik/v3.
- GHSA-46wh-3698-f2cxTraefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)—
- GHSA-4hjq-9h5c-252jTraefik: HTTP/2 frames can cause a running server to panic—
- CVE-2026-29777Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values6.5
- CVE-2026-29054Traefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)7.5
- CVE-2026-26999Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS)7.5
- CVE-2026-26998Traefik: unbounded io.ReadAll on auth server response body causes OOM denial of service(DOS)4.4
- GHSA-gv8r-9rw9-9697Traefik affected by TLS ClientAuth Bypass on HTTP/3—
- CVE-2026-25949Traefik: TCP readTimeout bypass via STARTTLS on Postgres7.5
- CVE-2026-22045Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall5.9
- CVE-2025-66491Traefik has Inverted TLS Verification Logic in its ingress-nginx Provider5.9
- CVE-2025-66490Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules6.5
- CVE-2025-54386Traefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution9.8
- CVE-2025-47952Traefik allows path traversal using url encoding9.1
- CVE-2025-32431Traefik has a possible vulnerability with the path matchers9.1
- GHSA-5423-jcjm-2gpvTraefik affected by Go HTTP Request Smuggling Vulnerability—
Product grouping is registry-driven, with AI assist and human review. How it works