Traefik affected by Go HTTP Request Smuggling Vulnerability

Vulnerability Details

Basic Information

Title Traefik affected by Go HTTP Request Smuggling Vulnerability
Type github
Published 2025-04-18T19:35:17
Last Seen 2025-04-18T21:43:26
CVSS Score 9.1 (CRITICAL)

CVSS v3 Details

Attack Vector NETWORK
Attack Complexity LOW
Privileges Required NONE
User Interaction NONE
Scope UNCHANGED
Confidentiality Impact HIGH
Integrity Impact HIGH
Availability Impact NONE

CVE Information

CVE IDs CVE-2025-22871
CWE CWE-1395
Bulletin Family software

Description

### Summary
net/http: request smuggling through invalid chunked data: The net/http package accepts data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permit request smuggling. [CVE-2025-22871] Vendor Affected Components: Go: 1.23.x < 1.23.8 More Details: [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) ## Patches - https://github.com/traefik/traefik/releases/tag/v2.11.24 - https://github.com/traefik/traefik/releases/tag/v3.3.6 - https://github.com/traefik/traefik/releases/tag/v3.4.0-rc2

Impact Assessment

Base Score 9.1
Severity CRITICAL

💭 Join the Security Discussion

🔒 Your email address will not be published. Required fields are marked *

⚠️ Please be respectful and constructive in your comments. Security discussions should remain professional.