Traefik vulnerabilities
80 CVEs and advisories name Traefik as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-25949Traefik: TCP readTimeout bypass via STARTTLS on Postgres
- CVE-2026-22045Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall
- CVE-2025-66491Traefik has Inverted TLS Verification Logic in its ingress-nginx Provider
- CVE-2025-66490Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules
- CVE-2025-54386Traefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution
- CVE-2025-47952Traefik allows path traversal using url encoding
- CVE-2025-32431Traefik has a possible vulnerability with the path matchers
- CVE-2024-52003X-Forwarded-Prefix Header still allows for Open Redirect in traefik
- CVE-2024-45410HTTP client can remove the X-Forwarded headers in Traefik
- CVE-2024-39321Traefik vulnerable to bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes
- CVE-2024-28869Possible denial of service vulnerability with Content-length header in Traefik
- CVE-2023-47633Uncontrolled Resource Consumption in Traefik
- CVE-2023-47106Incorrect processing of fragment in the URL leads to Authorization Bypass in Traefik
- CVE-2023-47124Denial of service whith ACME HTTPChallenge in Traefik
- CVE-2023-29013HTTP header parsing could cause a deny of service
- CVE-2022-46153Routes exposed with an empty TLSOption in traefik
- CVE-2022-23469Authorization header displayed in the debug logs
- CVE-2022-39271Traefik HTTP/2 connections management could cause a denial of service
- CVE-2022-23632Traefik skips the router TLS configuration when the host header is an FQDN
- CVE-2021-32813Drop Headers via Malicious Connection Header