CVE-2026-88009

Katalog CVE

CVSS 8.2 · High EPSS 0,44%

Kerentanan Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') pada traefik. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sanitization, forwardAuth, encodedCharacters, and access logging against a path normalized to / but forwards URL.Opaque verbatim to the backend, allowing cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion when the backend interprets the opaque target as a path. This issue is fixed in 2.11.57 and 3.7.13.

Rincian

Terbit di NVD

10 September 2026

Terakhir diubah

14 September 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-1286: Improper Validation of Syntactic Correctness of Input

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/traefik/traefik/security/advisories/GHSA-f52w-8j3h-j724 patch · advisory vendor
• https://github.com/traefik/traefik/commit/58d1e9ca204526823211e30fd4634101c59d58e9 patch
• https://github.com/traefik/traefik/pull/13796 issue tracking · patch
• https://github.com/traefik/traefik/releases/tag/v2.11.57 release notes
• https://github.com/traefik/traefik/releases/tag/v3.7.13 release notes