GHSA-m697-4v8f-55qg CVE-2021-32813 GO-2022-0923
Header dropping in traefik
- Severity
- 4.8 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 1.10%
- Chance of exploitation in the next 30 days. Higher than 65.68% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-913 Improper Control of Dynamically-Managed Code Resources
- Fix
2.4.13- Upgrade github.com/traefik/traefik/v2 to this version or later
Description
Impact
There exists a potential header vulnerability in Traefik's handling of the Connection header. Active exploitation of this issue is unlikely, as it requires that a removed header would lead to a privilege escalation, however, the Traefik team has addressed this issue to prevent any potential abuse.
Details
If you have a chain of Traefik middlewares, and one of them sets a request header Important-Security-Header, then sending a request with the following Connection header will cause it to be removed before the request was sent:
curl 'https://example.com' -H "Connection: Important-Security-Header" -0
In this case, the backend does not see the request header Important-Security-Header.
Patches
Traefik v2.4.x: https://github.com/traefik/traefik/releases/tag/v2.4.13
Workarounds
No.
For more information
If you have any questions or comments about this advisory, open an issue.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/traefik/traefik | <= 1.7.30 |
No fix yet |
| github.com/traefik/traefik | all versions |
No fix yet |
| github.com/traefik/traefik/v2 | < 2.4.13 |
2.4.13 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/traefik/traefik/v2 Go → 2.4.13
- go
go get github.com/traefik/traefik/v2@v2.4.13 && go mod tidy
Severity breakdown
CVSS 3.1 4.8
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Weakness
CWE-913: Improper Control of Dynamically-Managed Code Resources
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
How to prevent it
- Implementation: For any externally-influenced input, check the input against an allowlist of acceptable values.
- Implementation, Architecture and Design: Refactor the code so that it does not need to be dynamically managed.
References
Advisories
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GO-2026-6558 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle | Medium | Also affects github.com/traefik/traefik |
| GHSA-f52w-8j3h-j724 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging | High | Also affects github.com/traefik/traefik |
| GHSA-w4v4-9rw7-5326 Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization | Critical | Also affects github.com/traefik/traefik |
| GHSA-qqjf-53cj-pwvv Traefik HTTP/3 Backend NTLM Connection Reuse | Critical | Also affects github.com/traefik/traefik |
| GO-2026-6467 Traefik entrypoint header-name sanitization bypassed via request trailers | High | Also affects github.com/traefik/traefik |
| GHSA-rf44-j88r-hh8c Traefik: ForwardAuth identity spoofing via dot-form header alias | High | Also affects github.com/traefik/traefik |
| GHSA-7ghq-v6jf-g56c Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded | Medium | Also affects github.com/traefik/traefik |
| GHSA-62fc-8686-hfmq Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef | Medium | Also affects github.com/traefik/traefik |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor