GitHub Advisoryadvisory · Go

GHSA-gv8r-9rw9-9697 Traefik affected by TLS ClientAuth Bypass on HTTP/3

HIGH Published 2026-02-20 Modified 2026-03-11 Official page ↗
Ecosystem
Go
Packages
github.com/traefik/traefik, github.com/traefik/traefik/v2, github.com/traefik/traefik/v3
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Weaknesses
CWE-1395
Reviewed
2026-02-20

Affected packages

• Go github.com/traefik/traefik: <= 1.7.34 (no fix yet) • Go github.com/traefik/traefik/v2: < 2.11.37 → fixed in 2.11.37 • Go github.com/traefik/traefik/v3: < 3.6.8 → fixed in 3.6.8

Description

Summary There is a potential vulnerability in Traefik managing HTTP/3 connections. More details in the CVE-2025-68121. Patches • https://github.com/traefik/traefik/releases/tag/v2.11.37 • https://github.com/traefik/traefik/releases/tag/v3.6.8 Workarounds No workaround For more information If you have any questions or comments about this advisory, please open an issue.

Related

Weakness · CWE (1)

  • CWE-1395 Dependency on Vulnerable Third-Party Component weakness

References