CVE-2026-29054

설명

Traefik is an HTTP reverse proxy and load balancer. From version 2.11.9 to 2.11.37 and from version 3.1.3 to 3.6.8, there is a potential vulnerability in Traefik managing the Connection header with X-Forwarded headers. When Traefik processes HTTP/1.1 requests, the protection put in place to prevent the removal of Traefik-managed X-Forwarded headers (such as X-Real-Ip, X-Forwarded-Host, X-Forwarded-Port, etc.) via the Connection header does not handle case sensitivity correctly. The Connection tokens are compared case-sensitively against the protected header names, but the actual header dele...

영향 제품·버전

제품 traefik traefik, Red Hat OpenShift Dev Spaces 3.27

영향 버전 traefik traefik, Red Hat OpenShift Dev Spaces 3.27 >= >= 2.11.9, < 2.11.38, >= >= 3.1.3, < 3.6.9, >= 2.11.9 < 2.11.38, >= 3.1.3 < 3.6.9

수정 버전 traefik traefik, Red Hat OpenShift Dev Spaces 3.27 2.11.38, 3.6.9

기술 정보

CVSS 벡터 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE CWE-178

EPSS 데이터 기준일 2026.08.04