Description
Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. Prior to versions 2.11.25 and 3.4.1, there is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backend using a matcher based on the path, if the URL contains a URL encoded string in its path, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain. This issue has been patched in versions 2.11.25 and 3.4.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| traefik | traefik | < 3.4.1, < 2.11.25 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250529T205903-1.1 | openSUSE-SU-2025:15188-1 |
| openSUSE Tumbleweed | traefik | 3.4.3-1.1 | openSUSE-SU-2025:15304-1 |
| openSUSE Tumbleweed | traefik2 | 2.11.26-1.1 | openSUSE-SU-2025:15305-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | traefik-3.3 | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/traefik/traefik | <= 1.7.34 | — | GHSA-vrch-868g-9jx5 |
| Go | github.com/traefik/traefik | all versions | — | GO-2025-3719 |
| Go | github.com/traefik/traefik/v2 | < 2.11.25 | 2.11.25 | GHSA-vrch-868g-9jx5 |
| Go | github.com/traefik/traefik/v3 | < 3.4.1 | 3.4.1 | GHSA-vrch-868g-9jx5 |
Advisories 3
- openSUSE-SU-2025:15304-1 traefik-3.4.3-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15305-1 traefik2-2.11.26-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15188-1 govulncheck-vulndb-0.0.20250529T205903-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026