GITHUB.COM/TRAEFIK/TRAEFIK/V2 · GHSA-xv5x-242w-7hf7 · Package
FIX → v2.11.61 · v3.7.17
Traefik allocates a dedicated backend transport for each client connection whose request carries an NTLM or Negotiate Authorization header, even without valid credentials. Those transports and their goroutines are not released when the client disconnects, so an unauthenticated client opening many short-lived connections can exhaust memory, file descriptors and backend connections.
first public Nov 2, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any Traefik deployment on the affected v2.11.58 to 2.11.60 or v3.7.14 to 3.7.16 lines is exposed, because the allocation happens for any client request carrying the header, whether or not NTLM or Kerberos backends exist. Traefik 3.6 and earlier v3 lines and 2.11.57 and earlier are not affected. FastProxy reportedly has the same pattern.
Not affected if traefik-2.11.57-or-earlier, traefik-3.6-or-earlier
Who cares go, kubernetes, self-hosted, traefik
traefik version or the container image tag; affected v2 is >= 2.11.58 through 2.11.60, affected v3 is >= 3.7.14 through 3.7.16.There is a high severity vulnerability in Traefik's NTLM and Kerberos backend connection handling. Since v2.11.58 and v3.7.14, Traefik allocates a dedicated backend transport to a client connection as soon as a request carries an Authorization header with the NTLM or Negotiate scheme, without any valid credential or backend challenge. This transport, its idle backend connection and its goroutines are not released when the client connection closes, and the same pattern exists in FastProxy. An unauthenticated client can therefore open many short-lived connections and exhaust the memory, file descriptors and backend connections of the Traefik process, regardless of whether NTLM or Kerberos backends are configured. Traefik v3.6 and earlier v3 lines, and Traefik v2.11.57 and earlier, are not affected: they only dedicate a transport after the backend answers with a WWW-Authenticate: NTLM or Negotiate challenge.
If you have any questions or comments about this advisory, please open an issue.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to v2.11.61 · v3.7.17
2.11.61.3.7.17.