---
id: "GHSA-mhjw-hmjv-p99x"
page: "https://infrastack.ai/live/GHSA-mhjw-hmjv-p99x"
kind: "vulnerability"
aliases: ["GHSA-mhjw-hmjv-p99x"]
title: "Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/2 streams"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/traefik/traefik/v2", "fixed": ["v2.11.58"], "affected": ">= v2.11.0, <= v2.11.57", "ecosystem": "go"}, {"name": "github.com/traefik/traefik/v3", "fixed": ["v3.7.14"], "affected": ">= v3.0.0, <= v3.7.13", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cwe-362", "go", "kerberos", "kubernetes", "ntlm", "package", "self-hosted", "traefik"]
not_affected_if: ["no-kerberos-backends", "no-ntlm-backends", "traefik-v1"]
published_at: "2026-10-07T08:47:54+00:00"
first_seen_at: "2026-11-09T22:53:32+00:00"
updated_at: "2026-11-09T23:00:54+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/traefik/traefik/security/advisories/GHSA-mhjw-hmjv-p99x", "first_seen_at": "2026-11-09T22:53:32+00:00"}]
exploit_sources: []
---

# Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/2 streams

Link for people: https://infrastack.ai/live/GHSA-mhjw-hmjv-p99x (this .md is for agents)

Traefik stores a per-client-connection backend round tripper for NTLM and Kerberos (Negotiate) backend authentication, and it reads and writes that slot without a lock. Concurrent HTTP/2 or HTTP/3 requests on one client connection can replace an in-use round tripper, breaking connection-bound authentication, and a torn read may crash the Traefik process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/traefik/traefik/v2 affected >= v2.11.0, <= v2.11.57 fixed v2.11.58
- go:github.com/traefik/traefik/v3 affected >= v3.0.0, <= v3.7.13 fixed v3.7.14

## How to check

- Run `traefik version` or check the image tag to see whether you run a v2 release from `v2.11.0` through `v2.11.57`, or a v3 release from `v3.0.0` through `v3.7.13`.
- Check whether any service uses NTLM or Kerberos (Negotiate) backend authentication.

## Fix

- Traefik v2: move to `v2.11.58`.
- Traefik v3: move to `v3.7.14`.

## Timeline

- 2026-11-09T22:53:32+00:00 ghsa-repo https://github.com/traefik/traefik/security/advisories/GHSA-mhjw-hmjv-p99x

## Documents

- [advisory] Vendor advisory: github.com https://github.com/traefik/traefik/security/advisories/GHSA-mhjw-hmjv-p99x

## From the sources

## Summary

There is a medium severity vulnerability in Traefik's NTLM and Kerberos (Negotiate) backend authentication support. When a backend answers a request with a `WWW-Authenticate: NTLM` or `Negotiate` challenge, Traefik stores a dedicated backend round tripper in the client connection context so that the next requests on that client connection reuse the same authenticated backend connection. That per-connection slot was read and written without any synchronization, while HTTP/2 and HTTP/3 client connections multiplex concurrent requests over a single connection. Concurrent requests racing on the slot could replace a round tripper already in use, orphaning the backend connections it held and breaking the connection-bound authentication for that client, and a torn read of the slot may crash the Traefik process.

The fix guards the slot with a mutex and keeps the round tripper already stored for a client connection, so concurrent requests stick exactly once. The same change also dedicates the slot to the `ServersTransport` that created it, which is tracked separately as GHSA-cw35-4q88-3rmp.

Traefik v3.0 through v3.6 are affected and no longer receive patches; users on those lines must upgrade to v3.7.14. Traefik v2 is affected from v2.11.0, where NTLM and Kerberos support was introduced; earlier v2 releases and Traefik v1 are not affected.

## Patches

- https://github.com/traefik/traefik/releases/tag/v2.11.58
- https://github.com/traefik/traefik/releases/tag/v3.7.14

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_