GHSA-5423-jcjm-2gpv
Traefik affected by Go HTTP Request Smuggling Vulnerability
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut GHSA.
Beschreibung
### Summary net/http: request smuggling through invalid chunked data: The net/http package accepts data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permit request smuggling. [CVE-2025-22871] Vendor Affected Components: Go: 1.23.x < 1.23.8 More Details: [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) ## Patches - https://github.com/traefik/traefik/releases/tag/v2.11.24 - https://github.com/traefik/traefik/releases/tag/v3.3.6 - https://github.com/traefik/traefik/releases/tag/v3.4.0-rc2
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| go::GitHub Security Advisory Go | github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 | 2.11.24 und 1 weitere |
Alle 2 Einträge aus 1 Quelle zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| go::GitHub Security Advisory Go | github.com/traefik/traefik/v2 | 2.11.24 |
| go::GitHub Security Advisory Go | github.com/traefik/traefik/v3 | 3.3.6, 3.4.0-rc2 |
Referenzen
- https://github.com/traefik/traefik
- https://github.com/traefik/traefik/releases/tag/v2.11.24
- https://github.com/traefik/traefik/releases/tag/v3.3.6
- https://github.com/traefik/traefik/releases/tag/v3.4.0-rc2
- https://github.com/traefik/traefik/security/advisories/GHSA-5423-jcjm-2gpv
- https://nvd.nist.gov/vuln/detail/CVE-2025-22871