Traefik v3.7.12 Security Advisory: Fixes 4 CVEs in Ingress-Nginx, TCP/UDP, HTTP/3

Traefik v3.7.12 Release Notes Summary Vulnerability Overview This release fixes 4 security vulnerabilities (CVEs), all classified as Advisory level: > Note: Please read the migration guide before upgrading. Scope of Impact Affects versions prior to Traefik v3.7.12. Involves multiple components: , , , modules. Related issues include TLS option naming conflicts, HTTP/3 log messages, request header alias handling, and rejection of negative weights in TCP/UDP services. Fix Upgrading to v3.7.12 resolves the aforementioned CVEs and a series of bug fixes. Key Bug Fixes [ingress-nginx] Fixed TLS option naming conflicts ( ) [b8s] Fixed formatting issues in Kubernetes setup guide ( ) [server] Added an entry option to handle aliased request headers ( ) [tcp, udp] Reject negative weights in TCP and UDP weighted services ( ) [file] Include file name in file provider configuration errors ( ) [http3] Apply proper idle timeout and max header size for HTTP/3 ( ) [b8s] Fixed formatting in Kubernetes setup guide ( ) [security] Documented the security threat model and established security decisions ( ) [service] Clarified Server Transport behavior under misconfigured middleware in Kubernetes ( ) POC / Exploitation Code The release notes do not include any POC code or exploitation snippets. Other Information Publisher: , released 2 weeks ago 71 commits on the master branch since this version Contributors: , , and 7 other contributors (9 total) Assets: 22

Goal Reached Thanks to every supporter — we hit 100%!

Traefik v3.7.12 Security Advisory: Fixes 4 CVEs in Ingress-Nginx, TCP/UDP, HTTP/3

More from this source