{"id":"GHSA-mhjw-hmjv-p99x","kind":"vulnerability","aliases":["GHSA-mhjw-hmjv-p99x"],"related":[],"title":"Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/2 streams","description":"## Summary\n\nThere is a medium severity vulnerability in Traefik's NTLM and Kerberos (Negotiate) backend authentication support. When a backend answers a request with a `WWW-Authenticate: NTLM` or `Negotiate` challenge, Traefik stores a dedicated backend round tripper in the client connection context so that the next requests on that client connection reuse the same authenticated backend connection. That per-connection slot was read and written without any synchronization, while HTTP/2 and HTTP/3 client connections multiplex concurrent requests over a single connection. Concurrent requests racing on the slot could replace a round tripper already in use, orphaning the backend connections it held and breaking the connection-bound authentication for that client, and a torn read of the slot may crash the Traefik process.\n\nThe fix guards the slot with a mutex and keeps the round tripper already stored for a client connection, so concurrent requests stick exactly once. The same change also dedicates the slot to the `ServersTransport` that created it, which is tracked separately as GHSA-cw35-4q88-3rmp.\n\nTraefik v3.0 through v3.6 are affected and no longer receive patches; users on those lines must upgrade to v3.7.14. Traefik v2 is affected from v2.11.0, where NTLM and Kerberos support was introduced; earlier v2 releases and Traefik v1 are not affected.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.58\n- https://github.com/traefik/traefik/releases/tag/v3.7.14\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).","summary":"Traefik stores a per-client-connection backend round tripper for NTLM and Kerberos (Negotiate) backend authentication, and it reads and writes that slot without a lock. Concurrent HTTP/2 or HTTP/3 requests on one client connection can replace an in-use round tripper, breaking connection-bound authentication, and a torn read may crash the Traefik process.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/traefik/traefik/v2","fixed":["v2.11.58"],"affected":">= v2.11.0, <= v2.11.57","ecosystem":"go"},{"name":"github.com/traefik/traefik/v3","fixed":["v3.7.14"],"affected":">= v3.0.0, <= v3.7.13","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-362","go","kerberos","kubernetes","ntlm","package","self-hosted","traefik"],"not_affected_if":["no-kerberos-backends","no-ntlm-backends","traefik-v1"],"how_to_check":"- Run `traefik version` or check the image tag to see whether you run a v2 release from `v2.11.0` through `v2.11.57`, or a v3 release from `v3.0.0` through `v3.7.13`.\n- Check whether any service uses NTLM or Kerberos (Negotiate) backend authentication.","fix":"- Traefik v2: move to `v2.11.58`.\n- Traefik v3: move to `v3.7.14`.","status":"open","published_at":"2026-10-07T08:47:54+00:00","first_seen_at":"2026-11-09T22:53:32+00:00","triaged_at":"2026-11-09T23:00:54+00:00","updated_at":"2026-11-09T23:00:54+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T23:00:54Z","model":"claude-haiku-5-5","output":{"fix":"- Traefik v2: move to `v2.11.58`.\n- Traefik v3: move to `v3.7.14`.","reach":"network","title":"Traefik: unsynchronized connection state lets concurrent HTTP/2 requests crash or break NTLM auth","impact":"medium","summary":"Traefik stores a per-client-connection backend round tripper for NTLM and Kerberos (Negotiate) backend authentication, and it reads and writes that slot without a lock. Concurrent HTTP/2 or HTTP/3 requests on one client connection can replace an in-use round tripper, breaking connection-bound authentication, and a torn read may crash the Traefik process.","audience":"businesses","category":"package","nicknames":[],"who_cares":["traefik","go","self-hosted","kubernetes","ntlm","kerberos"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Traefik process may crash and client authentication breaks","analyst_note":"","how_to_check":"- Run `traefik version` or check the image tag to see whether you run a v2 release from `v2.11.0` through `v2.11.57`, or a v3 release from `v3.0.0` through `v3.7.13`.\n- Check whether any service uses NTLM or Kerberos (Negotiate) backend authentication.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-ntlm-backends","no-kerberos-backends","traefik-v1"],"who_is_affected":"Only deployments that proxy to backends using NTLM or Kerberos (Negotiate) authentication are exposed, because the flawed code path only runs when a backend sends those challenges. Traefik v2 from v2.11.0 and Traefik v3 from v3.0.0 to v3.7.13 are in range. Deployments that do not use NTLM or Kerberos backend auth can skip it, though upgrading is still advised.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000865,"input_tokens":5159,"output_tokens":699,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-362':33B '/traefik/traefik/issues).':342C '/traefik/traefik/releases/tag/v2.11.58':319C '/traefik/traefik/releases/tag/v3.7.14':322C '/traefik/traefik/v2':28A '/traefik/traefik/v3':31A '3rmp':274C '4q88':273C 'advisori':335C 'affect':280C,297C,315C 'alreadi':196C,240C 'also':255C 'answer':121C 'authent':59B,91B,116C,128C,157C,211C 'backend':50B,58B,115C,120C,137C,158C,201C 'bound':90B,210C 'break':87B,206C 'challeng':132C 'chang':254C 'client':48B,77B,142C,152C,176C,214C,244C 'comment':332C 'concurr':13A,70B,179C,185C,247C 'connect':7A,49B,78B,89B,143C,153C,159C,163C,177C,184C,202C,209C,245C 'connection-bound':88B,208C 'context':144C 'could':191C 'crash':97B,223C 'creat':263C 'cw35':272C 'cwe':32B 'dedic':136C,256C 'earlier':307C 'exact':250C 'fix':228C 'ghsa':17A,22A,271C 'ghsa-cw35-4q88-3rmp':270C 'ghsa-mhjw-hmjv-p99x':16A,21A 'github.com':27A,30A,318C,321C,341C 'github.com/traefik/traefik/issues).':340C 'github.com/traefik/traefik/releases/tag/v2.11.58':317C 'github.com/traefik/traefik/releases/tag/v3.7.14':320C 'github.com/traefik/traefik/v2':26A 'github.com/traefik/traefik/v3':29A 'go':34B 'guard':229C 'held':204C 'hmjv':19A,24A 'host':41B 'http/2':14A,71B,173C 'http/3':73B,175C 'in-us':82B 'inform':325C 'introduc':306C 'issu':339C 'keep':236C 'kerbero':35B,56B,113C,303C 'kubernet':36B 'line':289C 'lock':69B 'longer':283C 'may':96B,222C 'medium':105C 'mhjw':18A,23A 'multiplex':178C 'must':290C 'mutex':234C 'negoti':57B,114C,131C 'next':148C 'ntlm':37B,54B,111C,129C,301C 'one':76B 'open':337C 'orphan':199C 'p99x':20A,25A 'packag':38B 'patch':285C,316C 'per':6A,47B,162C 'per-client-connect':46B 'per-connect':5A,161C 'pleas':336C 'process':100B,226C 'question':330C 'race':187C 'read':62B,95B,166C,218C 'receiv':284C 'releas':309C 'replac':80B,192C 'request':74B,123C,149C,180C,186C,248C 'reus':154C 'round':9A,51B,85B,138C,194C,238C 'self':40B 'self-host':39B 'separ':268C 'serverstransport':261C 'sever':106C 'share':11A 'singl':183C 'slot':66B,164C,190C,221C,231C,258C 'stick':249C 'sticki':8A 'store':44B,134C,241C 'stream':15A 'summari':101C 'support':117C,304C 'synchron':171C 'torn':94B,217C 'track':267C 'traefik':42B,43B,99B,109C,133C,225C,275C,294C,311C 'tripper':10A,52B,86B,139C,195C,239C 'unsynchron':1A 'upgrad':291C 'use':84B,198C 'user':286C 'v1':312C 'v2':295C,308C 'v2.11.0':299C 'v3.0':276C 'v3.6':278C 'v3.7.14':293C 'vulner':107C 'without':67B,169C 'write':2A,64B 'written':168C 'www':127C 'www-authent':126C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that proxy to backends using NTLM or Kerberos (Negotiate) authentication are exposed, because the flawed code path only runs when a backend sends those challenges. Traefik v2 from v2.11.0 and Traefik v3 from v3.0.0 to v3.7.13 are in range. Deployments that do not use NTLM or Kerberos backend auth can skip it, though upgrading is still advised.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomtraefiktraefikv2","githubcomtraefiktraefikv3"],"ptokens":["com","github","traefik","v2","v3"],"labels":["cwe362","go","kerberos","kubernetes","medium","ntlm","package","selfhosted","traefik"],"campaign_type":null,"search_a":"'/traefik/traefik/v2':28A '/traefik/traefik/v3':31A 'concurr':13A 'connect':7A 'ghsa':17A,22A 'ghsa-mhjw-hmjv-p99x':16A,21A 'github.com':27A,30A 'github.com/traefik/traefik/v2':26A 'github.com/traefik/traefik/v3':29A 'hmjv':19A,24A 'http/2':14A 'mhjw':18A,23A 'p99x':20A,25A 'per':6A 'per-connect':5A 'round':9A 'share':11A 'sticki':8A 'stream':15A 'tripper':10A 'unsynchron':1A 'write':2A","search_b":"'-362':33B 'authent':59B,91B 'backend':50B,58B 'bound':90B 'break':87B 'client':48B,77B 'concurr':70B 'connect':49B,78B,89B 'connection-bound':88B 'crash':97B 'cwe':32B 'go':34B 'host':41B 'http/2':71B 'http/3':73B 'in-us':82B 'kerbero':35B,56B 'kubernet':36B 'lock':69B 'may':96B 'negoti':57B 'ntlm':37B,54B 'one':76B 'packag':38B 'per':47B 'per-client-connect':46B 'process':100B 'read':62B,95B 'replac':80B 'request':74B 'round':51B,85B 'self':40B 'self-host':39B 'slot':66B 'store':44B 'torn':94B 'traefik':42B,43B,99B 'tripper':52B,86B 'use':84B 'without':67B 'write':64B","search_c":"'/traefik/traefik/issues).':342C '/traefik/traefik/releases/tag/v2.11.58':319C '/traefik/traefik/releases/tag/v3.7.14':322C '3rmp':274C '4q88':273C 'advisori':335C 'affect':280C,297C,315C 'alreadi':196C,240C 'also':255C 'answer':121C 'authent':116C,128C,157C,211C 'backend':115C,120C,137C,158C,201C 'bound':210C 'break':206C 'challeng':132C 'chang':254C 'client':142C,152C,176C,214C,244C 'comment':332C 'concurr':179C,185C,247C 'connect':143C,153C,159C,163C,177C,184C,202C,209C,245C 'connection-bound':208C 'context':144C 'could':191C 'crash':223C 'creat':263C 'cw35':272C 'dedic':136C,256C 'earlier':307C 'exact':250C 'fix':228C 'ghsa':271C 'ghsa-cw35-4q88-3rmp':270C 'github.com':318C,321C,341C 'github.com/traefik/traefik/issues).':340C 'github.com/traefik/traefik/releases/tag/v2.11.58':317C 'github.com/traefik/traefik/releases/tag/v3.7.14':320C 'guard':229C 'held':204C 'http/2':173C 'http/3':175C 'inform':325C 'introduc':306C 'issu':339C 'keep':236C 'kerbero':113C,303C 'line':289C 'longer':283C 'may':222C 'medium':105C 'multiplex':178C 'must':290C 'mutex':234C 'negoti':114C,131C 'next':148C 'ntlm':111C,129C,301C 'open':337C 'orphan':199C 'patch':285C,316C 'per':162C 'per-connect':161C 'pleas':336C 'process':226C 'question':330C 'race':187C 'read':166C,218C 'receiv':284C 'releas':309C 'replac':192C 'request':123C,149C,180C,186C,248C 'reus':154C 'round':138C,194C,238C 'separ':268C 'serverstransport':261C 'sever':106C 'singl':183C 'slot':164C,190C,221C,231C,258C 'stick':249C 'store':134C,241C 'summari':101C 'support':117C,304C 'synchron':171C 'torn':217C 'track':267C 'traefik':109C,133C,225C,275C,294C,311C 'tripper':139C,195C,239C 'upgrad':291C 'use':198C 'user':286C 'v1':312C 'v2':295C,308C 'v2.11.0':299C 'v3.0':276C 'v3.6':278C 'v3.7.14':293C 'vulner':107C 'without':169C 'written':168C 'www':127C 'www-authent':126C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-07T08:47:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-mhjw-hmjv-p99x","url":"https://github.com/traefik/traefik/security/advisories/GHSA-mhjw-hmjv-p99x","severity":"medium","published_at":"2026-10-07T08:47:54+00:00","modified_at":"2026-10-07T08:47:54+00:00","first_seen_at":"2026-11-09T22:53:32+00:00","fetched_at":"2026-11-09T22:53:32+00:00","note":null}],"documents":[{"id":46273,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-mhjw-hmjv-p99x","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-07T08:47:54+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}