Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-88008 · CVE overview and exploitation status

EUVD-2026-75545

GHSA-w4v4-9rw7-5326

GO-2026-6468

cve-program · CVE-2026-88008

• https://github.com/traefik/traefik/security/advisories/GHSA-w4v4-9rw7-5326
• https://github.com/traefik/traefik/pull/13797
• https://github.com/traefik/traefik/commit/a277e94664ffc1ce9543df552d3bbf48d4d3b8b3
• https://github.com/traefik/traefik/releases/tag/v2.11.57
• https://github.com/traefik/traefik/releases/tag/v3.7.13

euvd · EUVD-2026-75545

• https://github.com/traefik/traefik/security/advisories/GHSA-w4v4-9rw7-5326
• https://github.com/traefik/traefik/pull/13797
• https://github.com/traefik/traefik/commit/a277e94664ffc1ce9543df552d3bbf48d4d3b8b3
• https://github.com/traefik/traefik/releases/tag/v2.11.57
• https://github.com/traefik/traefik/releases/tag/v3.7.13

nvd · CVE-2026-88008

• https://github.com/traefik/traefik/commit/a277e94664ffc1ce9543df552d3bbf48d4d3b8b3
• https://github.com/traefik/traefik/pull/13797
• https://github.com/traefik/traefik/releases/tag/v2.11.57
• https://github.com/traefik/traefik/releases/tag/v3.7.13
• https://github.com/traefik/traefik/security/advisories/GHSA-w4v4-9rw7-5326

osv · GHSA-w4v4-9rw7-5326

• https://github.com/traefik/traefik/security/advisories/GHSA-w4v4-9rw7-5326
• https://nvd.nist.gov/vuln/detail/CVE-2026-88008
• https://github.com/traefik/traefik/pull/13797
• https://github.com/traefik/traefik/commit/a277e94664ffc1ce9543df552d3bbf48d4d3b8b3
• https://github.com/traefik/traefik
• https://github.com/traefik/traefik/releases/tag/v2.11.57
• https://github.com/traefik/traefik/releases/tag/v3.7.13

osv · GO-2026-6468

• https://github.com/traefik/traefik/security/advisories/GHSA-w4v4-9rw7-5326
• https://nvd.nist.gov/vuln/detail/CVE-2026-88008
• https://github.com/traefik/traefik/commit/a277e94664ffc1ce9543df552d3bbf48d4d3b8b3
• https://github.com/traefik/traefik/pull/13797
• https://github.com/traefik/traefik/releases/tag/v2.11.57
• https://github.com/traefik/traefik/releases/tag/v3.7.13

• Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. … · Advisory content revised · 1 Nov 2026