GHSA-7jmw-8259-q9jx GO-2024-2917
Traefik has unexpected behavior with IPv4-mapped IPv6 addresses
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-180 Incorrect Behavior Order: Validate Before Canonicalize
- Fix
- Available
- 3 packages have a fixed version
Description
Impact
There is a vulnerability in Go managing various Is methods (IsPrivate, IsLoopback, etc) for IPv4-mapped IPv6 addresses.
They didn't work as expected returning false for addresses which would return true in their traditional IPv4 forms.
References
Patches
- https://github.com/traefik/traefik/releases/tag/v2.11.4
- https://github.com/traefik/traefik/releases/tag/v3.0.2
Workarounds
No workaround.
For more information
If you have any questions or comments about this advisory, please open an issue.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/traefik/traefik | < 2.11.4 |
2.11.4 |
| github.com/traefik/traefik | all versions |
No fix yet |
| github.com/traefik/traefik/v2 | < 2.11.4 |
2.11.4 |
| github.com/traefik/traefik/v3 | >= 3.0.0-beta3, < 3.0.2 |
3.0.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/traefik/traefik Go → 2.11.4
- go
go get github.com/traefik/traefik@v2.11.4 && go mod tidy
github.com/traefik/traefik/v2 Go → 2.11.4
- go
go get github.com/traefik/traefik/v2@v2.11.4 && go mod tidy
github.com/traefik/traefik/v3 Go → 3.0.2
- go
go get github.com/traefik/traefik/v3@v3.0.2 && go mod tidy
Weakness
CWE-180: Incorrect Behavior Order: Validate Before Canonicalize
The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.
How to prevent it
- Implementation: Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GO-2026-6558 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle | Medium | Also affects github.com/traefik/traefik |
| GHSA-f52w-8j3h-j724 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging | High | Also affects github.com/traefik/traefik |
| GHSA-w4v4-9rw7-5326 Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization | Critical | Also affects github.com/traefik/traefik |
| GHSA-qqjf-53cj-pwvv Traefik HTTP/3 Backend NTLM Connection Reuse | Critical | Also affects github.com/traefik/traefik |
| GO-2026-6467 Traefik entrypoint header-name sanitization bypassed via request trailers | High | Also affects github.com/traefik/traefik |
| GHSA-rf44-j88r-hh8c Traefik: ForwardAuth identity spoofing via dot-form header alias | High | Also affects github.com/traefik/traefik |
| GHSA-7ghq-v6jf-g56c Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded | Medium | Also affects github.com/traefik/traefik |
| GHSA-62fc-8686-hfmq Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef | Medium | Also affects github.com/traefik/traefik |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor