GHSA-hrhx-6h34-j5hc CVE-2022-23632 GO-2022-0325

Skip the router TLS configuration when the host header is an FQDN

High Go

Severity: 7.4 / 10; High · CVSS 3.1
Exploit chance (EPSS): 1.71%; Chance of exploitation in the next 30 days. Higher than 77.40% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-295 Improper Certificate Validation
Fix: 2.6.1; Upgrade github.com/traefik/traefik/v2 to this version or later

Description

Impact

People that configure mTLS between Traefik and clients.

For a request, the TLS configuration choice can be different than the router choice, which implies the use of a wrong TLS configuration.

When sending a request using FQDN handled by a router configured with a dedicated TLS configuration, the TLS configuration falls back to the default configuration that might not correspond to the configured one.
If the CNAME flattening is enabled, the selected TLS configuration is the SNI one and the routing uses the CNAME value, so this can skip the expected TLS configuration.

Patches

Traefik v2.6.x: https://github.com/traefik/traefik/releases/tag/v2.6.1

Workarounds

Add the FDQN to the host rule:

Example:

  whoami:
    image: traefik/whoami:v1.7.1
    labels:
      traefik.http.routers.whoami.rule: Host(`whoami.example.com`, `whoami.example.com.`)
      traefik.http.routers.whoami.tls: true
      traefik.http.routers.whoami.tls.options: mtls@file

There is no workaround if the CNAME flattening is enabled.

For more information

If you have any questions or comments about this advisory, please open an issue.

Affected versions

Go

Package	Vulnerable	Fixed in
github.com/traefik/traefik	`all versions`	No fix yet
github.com/traefik/traefik/v2	`< 2.6.1`	`2.6.1`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/traefik/traefik/v2 Go → `2.6.1`

go

go get github.com/traefik/traefik/v2@v2.6.1 && go mod tidy

Severity breakdown

CVSS 3.1 7.4

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack vector: Network
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

Weakness

CWE-295: Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

How to prevent it

Architecture and Design, Implementation: Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation: If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2022-23632

Packages

github.com/traefik/traefik

Timeline

Feb 16, 2022 Published
Mar 3, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GO-2026-6558 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle	Medium	Also affects github.com/traefik/traefik
GHSA-f52w-8j3h-j724 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging	High	Also affects github.com/traefik/traefik
GHSA-w4v4-9rw7-5326 Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization	Critical	Also affects github.com/traefik/traefik
GHSA-qqjf-53cj-pwvv Traefik HTTP/3 Backend NTLM Connection Reuse	Critical	Also affects github.com/traefik/traefik
GO-2026-6467 Traefik entrypoint header-name sanitization bypassed via request trailers	High	Also affects github.com/traefik/traefik
GHSA-rf44-j88r-hh8c Traefik: ForwardAuth identity spoofing via dot-form header alias	High	Also affects github.com/traefik/traefik
GHSA-7ghq-v6jf-g56c Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded	Medium	Also affects github.com/traefik/traefik
GHSA-62fc-8686-hfmq Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef	Medium	Also affects github.com/traefik/traefik

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor