GITHUB.COM/TRAEFIK/TRAEFIK/V2 · GHSA-rr42-h8r2-f28g · Infrastructure
FIX → v2.11.62 · v3.8.0-rc.2 +1
Traefik's BasicAuth middleware hashes passwords of any length with MD5-crypt, whose cost grows with password length. An unauthenticated attacker can send very long passwords, up to the 1 MiB header limit by default, to use large amounts of CPU per request and degrade availability.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run Traefik with BasicAuth middleware using MD5-crypt password hashes are exposed, since the flaw is reachable before authentication. Traefik deployments without BasicAuth, or that use other hash formats, are not described as affected by the sources.
Not affected if managed-hosting, no-basicauth-middleware
Who cares kubernetes, self-hosted, traefik
traefik version and compare it against the affected ranges.basicAuth middleware using $apr1$ or $1$ MD5-crypt hashes in the dynamic configuration.There is a potential vulnerability in Traefik's BasicAuth middleware. The middleware does not limit the length of the password before it hashes it, and the MD5-crypt hash formats ($apr1$, $1$) take more CPU time as the password gets longer. An unauthenticated attacker can send requests with passwords up to the entry point maxHeaderBytes limit (1 MiB by default) and use a large amount of CPU on each request, which degrades the availability of Traefik. The patched versions reject passwords longer than 1024 bytes.
If you have any questions or comments about this advisory, please open an issue.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to v2.11.62 · v3.8.0-rc.2 +1
v2.11.62v3.7.18v3.8.0-rc.2