PkgSeer

Vulnerability GO-2026-6558

Unknown

6 hours ago

Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

v1.0.0-beta.211 - v2.0.0-beta1+incompatible

Summary

Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Details

Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/traefik/traefik from v3.6.11 before v3.7.13.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded in github.com/traefik/traefik

v1.0.0-beta.211 - v2.0.0-beta1+incompatible GO-2026-6454

Traefik: ForwardAuth identity spoofing via dot-form header alias in github.com/traefik/traefik

v1.0.0-beta.211 - v2.0.0-beta1+incompatible GO-2026-6455

Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging in github.com/traefik/traefik

v1.0.0-beta.211 - v2.0.0-beta1+incompatible GO-2026-6465

Traefik HTTP/3 Backend NTLM Connection Reuse in github.com/traefik/traefik

v1.0.0-beta.211 - v2.0.0-beta1+incompatible GO-2026-6466

Traefik entrypoint header-name sanitization bypassed via request trailers in github.com/traefik/traefik

v1.0.0-beta.211 - v2.0.0-beta1+incompatible GO-2026-6467

View all vulnerabilities for these packages

Impacted packages

github.com/traefik/traefik

Timeline

Published

6 hours ago

Last Modified

6 hours ago