{"id":"GHSA-xv5x-242w-7hf7","kind":"vulnerability","aliases":["GHSA-xv5x-242w-7hf7"],"related":[],"title":"Per-connection backend transport leak from unauthenticated Negotiate/NTLM headers (3.7.14+)","description":"## Summary\n\nThere is a high severity vulnerability in Traefik's NTLM and Kerberos backend connection handling. Since v2.11.58 and v3.7.14, Traefik allocates a dedicated backend transport to a client connection as soon as a request carries an `Authorization` header with the `NTLM` or `Negotiate` scheme, without any valid credential or backend challenge. This transport, its idle backend connection and its goroutines are not released when the client connection closes, and the same pattern exists in FastProxy. An unauthenticated client can therefore open many short-lived connections and exhaust the memory, file descriptors and backend connections of the Traefik process, regardless of whether NTLM or Kerberos backends are configured. Traefik v3.6 and earlier v3 lines, and Traefik v2.11.57 and earlier, are not affected: they only dedicate a transport after the backend answers with a `WWW-Authenticate: NTLM` or `Negotiate` challenge.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.61\n- https://github.com/traefik/traefik/releases/tag/v3.7.17\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).","summary":"Traefik allocates a dedicated backend transport for each client connection whose request carries an NTLM or Negotiate Authorization header, even without valid credentials. Those transports and their goroutines are not released when the client disconnects, so an unauthenticated client opening many short-lived connections can exhaust memory, file descriptors and backend connections.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/traefik/traefik/v2","fixed":["v2.11.61"],"affected":">= v2.11.58, <= v2.11.60","ecosystem":"go"},{"name":"github.com/traefik/traefik/v3","fixed":["v3.7.17"],"affected":">= v3.7.14, <= v3.7.16","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-400","cwe-772","go","kubernetes","package","self-hosted","traefik"],"not_affected_if":["traefik-2.11.57-or-earlier","traefik-3.6-or-earlier"],"how_to_check":"- Check the Traefik version with `traefik version` or the container image tag; affected v2 is `>= 2.11.58` through `2.11.60`, affected v3 is `>= 3.7.14` through `3.7.16`.\n- Note that the flaw applies regardless of whether NTLM or Kerberos backends are configured.","fix":"- Traefik v2 line: move to `2.11.61`.\n- Traefik v3 line: move to `3.7.17`.","status":"open","published_at":"2026-11-02T09:15:05+00:00","first_seen_at":"2026-11-09T22:53:32+00:00","triaged_at":"2026-11-09T22:54:24+00:00","updated_at":"2026-11-09T22:54:24+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-09T22:54:24Z","model":"claude-haiku-5-5","output":{"fix":"- Traefik v2 line: move to `2.11.61`.\n- Traefik v3 line: move to `3.7.17`.","reach":"internet","title":"Traefik: unauthenticated NTLM headers exhaust memory and connections on proxy","impact":"medium","summary":"Traefik allocates a dedicated backend transport for each client connection whose request carries an NTLM or Negotiate Authorization header, even without valid credentials. Those transports and their goroutines are not released when the client disconnects, so an unauthenticated client opening many short-lived connections can exhaust memory, file descriptors and backend connections.","audience":"businesses","category":"package","nicknames":[],"who_cares":["traefik","self-hosted","kubernetes","go"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated clients exhaust proxy memory, file descriptors and backend connections.","analyst_note":"","how_to_check":"- Check the Traefik version with `traefik version` or the container image tag; affected v2 is `>= 2.11.58` through `2.11.60`, affected v3 is `>= 3.7.14` through `3.7.16`.\n- Note that the flaw applies regardless of whether NTLM or Kerberos backends are configured.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["traefik-3.6-or-earlier","traefik-2.11.57-or-earlier"],"who_is_affected":"Any Traefik deployment on the affected v2.11.58 to 2.11.60 or v3.7.14 to 3.7.16 lines is exposed, because the allocation happens for any client request carrying the header, whether or not NTLM or Kerberos backends exist. Traefik 3.6 and earlier v3 lines and 2.11.57 and earlier are not affected. FastProxy reportedly has the same pattern.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000852,"input_tokens":5031,"output_tokens":698,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-400':29B '-772':31B '/traefik/traefik/issues).':259C '/traefik/traefik/releases/tag/v2.11.61':236C '/traefik/traefik/releases/tag/v3.7.17':239C '/traefik/traefik/v2':24A '/traefik/traefik/v3':27A '242w':15A,20A '3.7.14':11A '7hf7':16A,21A 'advisori':252C 'affect':214C 'alloc':40B,113C 'answer':223C 'authent':228C 'author':56B,129C 'backend':4A,43B,90B,105C,116C,142C,148C,186C,198C,222C 'carri':51B,127C 'challeng':143C,232C 'client':47B,72B,77B,120C,158C,170C 'close':160C 'comment':249C 'configur':200C 'connect':3A,48B,83B,91B,106C,121C,149C,159C,178C,187C 'credenti':61B,140C 'cwe':28B,30B 'dedic':42B,115C,217C 'descriptor':88B,184C 'disconnect':73B 'earlier':204C,211C 'even':58B 'exhaust':85B,180C 'exist':165C 'fastproxi':167C 'file':87B,183C 'ghsa':13A,18A 'ghsa-xv5x-242w-7hf7':12A,17A 'github.com':23A,26A,235C,238C,258C 'github.com/traefik/traefik/issues).':257C 'github.com/traefik/traefik/releases/tag/v2.11.61':234C 'github.com/traefik/traefik/releases/tag/v3.7.17':237C 'github.com/traefik/traefik/v2':22A 'github.com/traefik/traefik/v3':25A 'go':32B 'goroutin':66B,152C 'handl':107C 'header':10A,57B,130C 'high':96C 'host':37B 'idl':147C 'inform':242C 'issu':256C 'kerbero':104C,197C 'kubernet':33B 'leak':6A 'line':206C 'live':82B,177C 'mani':79B,174C 'memori':86B,182C 'negoti':55B,135C,231C 'negotiate/ntlm':9A 'ntlm':53B,102C,133C,195C,229C 'open':78B,173C,254C 'packag':34B 'patch':233C 'pattern':164C 'per':2A 'per-connect':1A 'pleas':253C 'process':191C 'question':247C 'regardless':192C 'releas':69B,155C 'request':50B,126C 'scheme':136C 'self':36B 'self-host':35B 'sever':97C 'short':81B,176C 'short-liv':80B,175C 'sinc':108C 'soon':123C 'summari':92C 'therefor':172C 'traefik':38B,39B,100C,112C,190C,201C,208C 'transport':5A,44B,63B,117C,145C,219C 'unauthent':8A,76B,169C 'v2.11.57':209C 'v2.11.58':109C 'v3':205C 'v3.6':202C 'v3.7.14':111C 'valid':60B,139C 'vulner':98C 'whether':194C 'whose':49B 'without':59B,137C 'www':227C 'www-authent':226C 'xv5x':14A,19A","nicknames":[],"mitigations":[],"who_affected":"Any Traefik deployment on the affected v2.11.58 to 2.11.60 or v3.7.14 to 3.7.16 lines is exposed, because the allocation happens for any client request carrying the header, whether or not NTLM or Kerberos backends exist. Traefik 3.6 and earlier v3 lines and 2.11.57 and earlier are not affected. FastProxy reportedly has the same pattern.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomtraefiktraefikv2","githubcomtraefiktraefikv3"],"ptokens":["com","github","traefik","v2","v3"],"labels":["cwe400","cwe772","go","high","kubernetes","package","selfhosted","traefik"],"campaign_type":null,"search_a":"'/traefik/traefik/v2':24A '/traefik/traefik/v3':27A '242w':15A,20A '3.7.14':11A '7hf7':16A,21A 'backend':4A 'connect':3A 'ghsa':13A,18A 'ghsa-xv5x-242w-7hf7':12A,17A 'github.com':23A,26A 'github.com/traefik/traefik/v2':22A 'github.com/traefik/traefik/v3':25A 'header':10A 'leak':6A 'negotiate/ntlm':9A 'per':2A 'per-connect':1A 'transport':5A 'unauthent':8A 'xv5x':14A,19A","search_b":"'-400':29B '-772':31B 'alloc':40B 'author':56B 'backend':43B,90B 'carri':51B 'client':47B,72B,77B 'connect':48B,83B,91B 'credenti':61B 'cwe':28B,30B 'dedic':42B 'descriptor':88B 'disconnect':73B 'even':58B 'exhaust':85B 'file':87B 'go':32B 'goroutin':66B 'header':57B 'host':37B 'kubernet':33B 'live':82B 'mani':79B 'memori':86B 'negoti':55B 'ntlm':53B 'open':78B 'packag':34B 'releas':69B 'request':50B 'self':36B 'self-host':35B 'short':81B 'short-liv':80B 'traefik':38B,39B 'transport':44B,63B 'unauthent':76B 'valid':60B 'whose':49B 'without':59B","search_c":"'/traefik/traefik/issues).':259C '/traefik/traefik/releases/tag/v2.11.61':236C '/traefik/traefik/releases/tag/v3.7.17':239C 'advisori':252C 'affect':214C 'alloc':113C 'answer':223C 'authent':228C 'author':129C 'backend':105C,116C,142C,148C,186C,198C,222C 'carri':127C 'challeng':143C,232C 'client':120C,158C,170C 'close':160C 'comment':249C 'configur':200C 'connect':106C,121C,149C,159C,178C,187C 'credenti':140C 'dedic':115C,217C 'descriptor':184C 'earlier':204C,211C 'exhaust':180C 'exist':165C 'fastproxi':167C 'file':183C 'github.com':235C,238C,258C 'github.com/traefik/traefik/issues).':257C 'github.com/traefik/traefik/releases/tag/v2.11.61':234C 'github.com/traefik/traefik/releases/tag/v3.7.17':237C 'goroutin':152C 'handl':107C 'header':130C 'high':96C 'idl':147C 'inform':242C 'issu':256C 'kerbero':104C,197C 'line':206C 'live':177C 'mani':174C 'memori':182C 'negoti':135C,231C 'ntlm':102C,133C,195C,229C 'open':173C,254C 'patch':233C 'pattern':164C 'pleas':253C 'process':191C 'question':247C 'regardless':192C 'releas':155C 'request':126C 'scheme':136C 'sever':97C 'short':176C 'short-liv':175C 'sinc':108C 'soon':123C 'summari':92C 'therefor':172C 'traefik':100C,112C,190C,201C,208C 'transport':117C,145C,219C 'unauthent':169C 'v2.11.57':209C 'v2.11.58':109C 'v3':205C 'v3.6':202C 'v3.7.14':111C 'valid':139C 'vulner':98C 'whether':194C 'without':137C 'www':227C 'www-authent':226C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-02T09:15:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-xv5x-242w-7hf7","url":"https://github.com/traefik/traefik/security/advisories/GHSA-xv5x-242w-7hf7","severity":"high","published_at":"2026-11-02T09:15:05+00:00","modified_at":"2026-11-02T09:15:05+00:00","first_seen_at":"2026-11-09T22:53:32+00:00","fetched_at":"2026-11-09T22:53:32+00:00","note":null}],"documents":[{"id":110718,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-xv5x-242w-7hf7","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}