Executive brief
A vulnerability in Traefik's reverse proxy allows an attacker to perform response poisoning, where one user may receive the web response intended for another user. This occurs when Traefik incorrectly reuses backend connections after certain types of network requests. This could lead to the exposure of private user data, session tokens, or other sensitive information to unauthorized parties.
Technical details
Traefik's default reverse proxy (using net/http/httputil) forwards HTTP/2 or HTTP/3 CONNECT requests to HTTP/1.1 upstreams without framing the body. If the upstream responds with a keep-alive non-2xx status without draining the body, the backend socket becomes desynchronized. This socket is then returned to Traefik's shared connection pool. When a subsequent client reuses this socket, they may receive a response smuggled by the previous attacker or a response intended for a different user. The vulnerability also affects the ForwardAuth middleware when configured to forward request bodies. Patches are available in versions 2.11.53, 3.6.24, and 3.7.9.
Affected products
- traefik traefik <= 1.7.34, <= 2.11.52, <= 3.6.23, >= 3.7.0, <= 3.7.8
Timeline
- 2026-07-27: disclosed
- 2026-08-06: advisory