---
id: "GHSA-xv5x-242w-7hf7"
page: "https://infrastack.ai/live/GHSA-xv5x-242w-7hf7"
kind: "vulnerability"
aliases: ["GHSA-xv5x-242w-7hf7"]
title: "Per-connection backend transport leak from unauthenticated Negotiate/NTLM headers (3.7.14+)"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/traefik/traefik/v2", "fixed": ["v2.11.61"], "affected": ">= v2.11.58, <= v2.11.60", "ecosystem": "go"}, {"name": "github.com/traefik/traefik/v3", "fixed": ["v3.7.17"], "affected": ">= v3.7.14, <= v3.7.16", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cwe-400", "cwe-772", "go", "kubernetes", "package", "self-hosted", "traefik"]
not_affected_if: ["traefik-2.11.57-or-earlier", "traefik-3.6-or-earlier"]
published_at: "2026-11-02T09:15:05+00:00"
first_seen_at: "2026-11-09T22:53:32+00:00"
updated_at: "2026-11-09T22:54:24+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/traefik/traefik/security/advisories/GHSA-xv5x-242w-7hf7", "first_seen_at": "2026-11-09T22:53:32+00:00"}]
exploit_sources: []
---

# Per-connection backend transport leak from unauthenticated Negotiate/NTLM headers (3.7.14+)

Link for people: https://infrastack.ai/live/GHSA-xv5x-242w-7hf7 (this .md is for agents)

Traefik allocates a dedicated backend transport for each client connection whose request carries an NTLM or Negotiate Authorization header, even without valid credentials. Those transports and their goroutines are not released when the client disconnects, so an unauthenticated client opening many short-lived connections can exhaust memory, file descriptors and backend connections.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/traefik/traefik/v2 affected >= v2.11.58, <= v2.11.60 fixed v2.11.61
- go:github.com/traefik/traefik/v3 affected >= v3.7.14, <= v3.7.16 fixed v3.7.17

## How to check

- Check the Traefik version with `traefik version` or the container image tag; affected v2 is `>= 2.11.58` through `2.11.60`, affected v3 is `>= 3.7.14` through `3.7.16`.
- Note that the flaw applies regardless of whether NTLM or Kerberos backends are configured.

## Fix

- Traefik v2 line: move to `2.11.61`.
- Traefik v3 line: move to `3.7.17`.

## Timeline

- 2026-11-09T22:53:32+00:00 ghsa-repo https://github.com/traefik/traefik/security/advisories/GHSA-xv5x-242w-7hf7

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/traefik/traefik/security/advisories/GHSA-xv5x-242w-7hf7

## From the sources

## Summary

There is a high severity vulnerability in Traefik's NTLM and Kerberos backend connection handling. Since v2.11.58 and v3.7.14, Traefik allocates a dedicated backend transport to a client connection as soon as a request carries an `Authorization` header with the `NTLM` or `Negotiate` scheme, without any valid credential or backend challenge. This transport, its idle backend connection and its goroutines are not released when the client connection closes, and the same pattern exists in FastProxy. An unauthenticated client can therefore open many short-lived connections and exhaust the memory, file descriptors and backend connections of the Traefik process, regardless of whether NTLM or Kerberos backends are configured. Traefik v3.6 and earlier v3 lines, and Traefik v2.11.57 and earlier, are not affected: they only dedicate a transport after the backend answers with a `WWW-Authenticate: NTLM` or `Negotiate` challenge.

## Patches

- https://github.com/traefik/traefik/releases/tag/v2.11.61
- https://github.com/traefik/traefik/releases/tag/v3.7.17

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_