CVE Reports

Posted on Aug 6 • Originally published at cvereports.com

CVE-2026-71324: CVE-2026-71324: Cross-User Response Poisoning in Traefik via HTTP/2 and HTTP/3 CONNECT Handling

#security #cve #cybersecurity

CVE-2026-71324: Cross-User Response Poisoning in Traefik via HTTP/2 and HTTP/3 CONNECT Handling

Vulnerability ID: CVE-2026-71324
CVSS Score: 7.0
Published: 2026-08-06

CVE-2026-71324 is a high-severity HTTP request smuggling vulnerability in the Traefik reverse proxy. It allows an unauthenticated remote attacker to achieve cross-user response poisoning when Traefik is configured to route HTTP/2 or HTTP/3 CONNECT requests to an HTTP/1.1 upstream backend. By sending a crafted CONNECT request that is subsequently rejected by the backend with a keep-alive non-2xx response, the attacker can leave smuggled requests within the shared connection pool, which are then served to subsequent clients.

TL;DR

An unauthenticated remote attacker can poison the backend connection pool in Traefik by sending HTTP/2 or HTTP/3 CONNECT requests containing smuggled payloads. When the upstream HTTP/1.1 server rejects the tunnel, unconsumed payload bytes remain in the connection buffer and are served to other users.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-444
Attack Vector: Network
CVSS v4.0 Score: 7.0 (High)
Exploit Status: Proof-of-Concept
KEV Status: Not Listed
Impact: Cross-User Response Poisoning

Affected Systems

Traefik Proxy (versions < 2.11.53)
Traefik Proxy (versions 3.0.0 to 3.6.23)
Traefik Proxy (versions 3.7.0 to 3.7.8)
Traefik: < 2.11.53 (Fixed in: 2.11.53)
Traefik: >= 3.0.0, < 3.6.24 (Fixed in: 3.6.24)
Traefik: >= 3.7.0, < 3.7.9 (Fixed in: 3.7.9)

Code Analysis

Commit: 04d36f2

Discard CONNECT Body in ForwardAuth & Reject in FastProxy

Commit: 0807b6d

Do Not Pool Connections Used for CONNECT

Commit: 94a7508

Defer CONNECT Payload Delivery via Pipe Middleware

Exploit Details

GitHub Security Advisory: Original security disclosure and analysis document.

Mitigation Strategies

Upgrade Traefik to a patched version (2.11.53, 3.6.24, or 3.7.9).
Disable HTTP/2 and HTTP/3 on Traefik entrypoints to prevent Extended CONNECT negotiations.
Disable 'forwardBody' and 'preserveRequestMethod' in the ForwardAuth middleware configuration.
Configure WAF rules to block external client requests that employ the CONNECT method.

Remediation Steps:

Identify the current running version of Traefik in your environment.
Download the matching patched release (e.g., v3.7.9 if currently on v3.7.x) from the official repository.
Update deployment manifests or container image references to point to the new version.
Perform a rolling restart of the Traefik proxy instances to apply the changes.
Validate that HTTP/2 and HTTP/3 services function correctly and monitor connection metrics.

References

Read the full report for CVE-2026-71324 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community