CVE-2024-52003
Fixed in a distro release EPSS <1%CVSS 6.3
Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-Prefix header from an untrusted source. This issue has been addressed in versions 2.11.14 and 3.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Products: traefik
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/traefik/traefik | no fix |
| Go | github.com/traefik/traefik/v2 | 2.11.14 |
| Go | github.com/traefik/traefik/v3 | 3.2.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | traefik-2.11 | 2.11.14-r0 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20241209T183251-1.1 |