---
id: "GHSA-rr42-h8r2-f28g"
page: "https://infrastack.ai/live/GHSA-rr42-h8r2-f28g"
kind: "vulnerability"
aliases: ["GHSA-rr42-h8r2-f28g"]
title: "Unbounded BasicAuth password length gives ~1857x CPU amplification through MD5-crypt, pre-authentication"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "github.com/traefik/traefik/v2", "fixed": ["v2.11.62"], "affected": "<= v2.11.61", "ecosystem": "go"}, {"name": "github.com/traefik/traefik/v3", "fixed": ["v3.7.18"], "affected": ">= v3.0.0, <= v3.7.17", "ecosystem": "go"}, {"name": "github.com/traefik/traefik/v3", "fixed": ["v3.8.0-rc.2"], "affected": ">= v3.8.0-rc.1, <= v3.8.0-rc.1", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cwe-770", "infrastructure", "kubernetes", "self-hosted", "traefik"]
not_affected_if: ["managed-hosting", "no-basicauth-middleware"]
published_at: "2026-11-12T10:01:25+00:00"
first_seen_at: "2026-11-12T10:09:07+00:00"
updated_at: "2026-11-12T10:10:21+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/traefik/traefik/security/advisories/GHSA-rr42-h8r2-f28g", "first_seen_at": "2026-11-12T10:09:07+00:00"}]
exploit_sources: []
---

# Unbounded BasicAuth password length gives ~1857x CPU amplification through MD5-crypt, pre-authentication

Link for people: https://infrastack.ai/live/GHSA-rr42-h8r2-f28g (this .md is for agents)

Traefik's BasicAuth middleware hashes passwords of any length with MD5-crypt, whose cost grows with password length. An unauthenticated attacker can send very long passwords, up to the 1 MiB header limit by default, to use large amounts of CPU per request and degrade availability.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/traefik/traefik/v2 affected <= v2.11.61 fixed v2.11.62
- go:github.com/traefik/traefik/v3 affected >= v3.0.0, <= v3.7.17 fixed v3.7.18
- go:github.com/traefik/traefik/v3 affected >= v3.8.0-rc.1, <= v3.8.0-rc.1 fixed v3.8.0-rc.2

## How to check

- Check the Traefik version with `traefik version` and compare it against the affected ranges.
- Look for `basicAuth` middleware using `$apr1$` or `$1$` MD5-crypt hashes in the dynamic configuration.

## Fix

- Traefik v2: move to `v2.11.62`
- Traefik v3: move to `v3.7.18`
- Traefik v3.8.0-rc.1: move to `v3.8.0-rc.2`

## Timeline

- 2026-11-12T10:09:07+00:00 ghsa-repo https://github.com/traefik/traefik/security/advisories/GHSA-rr42-h8r2-f28g

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/traefik/traefik/security/advisories/GHSA-rr42-h8r2-f28g

## From the sources

## Summary

There is a potential vulnerability in Traefik's BasicAuth middleware. The middleware does not limit the length of the password before it hashes it, and the MD5-crypt hash formats (`$apr1$`, `$1$`) take more CPU time as the password gets longer. An unauthenticated attacker can send requests with passwords up to the entry point `maxHeaderBytes` limit (1 MiB by default) and use a large amount of CPU on each request, which degrades the availability of Traefik. The patched versions reject passwords longer than 1024 bytes.

## Patches

- https://github.com/traefik/traefik/releases/tag/v2.11.62
- https://github.com/traefik/traefik/releases/tag/v3.7.18
- https://github.com/traefik/traefik/releases/tag/v3.8.0-rc.2

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_