Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*

2 briefs RSS
low advisory

Service Exhaustion via Stalled TLS ALPN Handshakes

Attackers are exploiting unpatched TLS listeners by flooding them with incomplete ACME ALPN handshakes to exhaust server-side resources like goroutines and worker threads.

PoC Traefik +7
1t 2c 2i updated
high advisory

Traefik ForwardAuth Authentication Bypass via Header Spoofing

Traefik's `ForwardAuth` and snippet-based authentication middleware has a high severity authentication bypass vulnerability because it does not sanitize header aliases with underscores, allowing attackers to spoof trust context and bypass authentication on protected routes.

PoC Traefik +1 authentication-bypass header-injection forwarded-headers
2r 1t 2c updated