Listen to this Post
CVE-2026-71324 is a critical vulnerability in Traefik’s default HTTP reverse proxy that enables unauthenticated cross-user response poisoning. The flaw resides in how Traefik forwards HTTP/2 and HTTP/3 `CONNECT` requests to HTTP/1.1 upstream backends via a shared net/http.Transport.
When a client sends an HTTP/2 or HTTP/3 `CONNECT` request, Traefik forwards the entire request—including its body—to the upstream backend. The attacker places a raw HTTP/1.1 request (e.g., GET /delay/2) inside the `CONNECT` body. Traefik’s default proxy, which is `net/http/httputil.ReverseProxy` over a shared http.Transport, writes this body unframed to the backend socket.
If the upstream backend responds to the `CONNECT` with a keep-alive non-2xx status (e.g., 405 Method Not Allowed) and does not drain the remaining body, the backend parses the trailing bytes as a pipelined HTTP request. The `net/http` client reads the non-2xx response and returns the socket to Traefik’s shared idle connection pool once the request body reaches EOF. However, the smuggled request’s response is still pending on that same socket.
A different client that later reuses this pooled socket will read the pending smuggled response as if it were its own. This allows an attacker to poison the connection pool and cause one client to receive another client’s response—potentially containing authenticated or private data.
Traefik’s `sanitizePath` option (default true) rewrites the `CONNECT` path to /, but this is not a reliable defense. While it prevents the attack against backends like Apache and nginx that close the connection on CONNECT /, it does not protect against Go `net/http` servers or gunicorn/Flask, which respond with a keep-alive non-2xx and remain exploitable. The issue is fixed by deferring the forwarded `CONNECT` payload until the backend accepts the tunnel, preventing `CONNECT` connections from being returned to the shared idle pool, and discarding the `CONNECT` body in the ForwardAuth path.
DailyCVE Form:
Platform: Traefik
Version: v3.6.23, v3.7.0-3.7.8
Vulnerability: Cross-user response poisoning
Severity: Critical
date: 2026-08-06
Prediction: 2026-07-24
What Undercode Say:
Verify Traefik version docker run --rm traefik:v3.6.23 traefik version Check backend keep-alive pool settings (default MaxIdleConnsPerHost=200) This is not directly exposed, but can be inferred from behavior Simulate attacker CONNECT with smuggled request curl -X CONNECT -H "Host: backend:80" -H "Content-Type: application/octet-stream" \ --http2-prior-knowledge -d "GET /delay/2?tag=ATTACKER_SMUGGLED HTTP/1.1\r\nHost: backend\r\n\r\n" \ http://traefik:8080 Victim request that will receive smuggled response curl -H "Host: backend:80" --http2-prior-knowledge http://traefik:8080/get?tag=VICTIM_OWN
Exploit:
- Prerequisite: Traefik is configured as a reverse proxy to an HTTP/1.1 upstream with default keep-alive pooling (
MaxIdleConnsPerHost> 0). The frontend must be HTTP/2 or HTTP/3; HTTP/1.1 frontend is not affected. - Smuggle: Attacker opens an HTTP/2 or HTTP/3 `CONNECT` stream to Traefik and sends a raw HTTP/1.1 request (e.g.,
GET /delay/2) as the `CONNECT` body, then half-closes the stream. - Desynchronize: Traefik forwards the `CONNECT` to the backend, which responds with a keep-alive non-2xx and parses the smuggled request. The backend socket is returned to the shared pool while the smuggled response is still pending.
- Poison: A different victim client reuses the poisoned socket and receives the smuggled response instead of its own.
Protection:
- Upgrade to Traefik v3.6.24 or v3.7.9, which contain the official fixes.
- Disable backend keep-alive pooling by setting `maxIdleConnsPerHost: -1` in the transport configuration (mitigates but may impact performance).
- Use the experimental FastProxy (
experimental.fastProxy) which is not affected as it chunk-frames the `CONNECT` body. - Configure backends (e.g., Apache, nginx) to close connections on `CONNECT /` by returning `Connection: close` with non-2xx responses.
Impact:
- Confidentiality: An unauthenticated attacker can cause one client to receive another client’s response, potentially exposing authenticated session data, private content, or API keys.
- Integrity: The attacker can inject arbitrary responses, leading to response poisoning and potential XSS or data corruption.
- Availability: The desynchronization can shift entire response queues, causing clients to receive incorrect responses and disrupting normal service operation.
- Scope: Affects all Traefik v3 deployments using the default reverse proxy with HTTP/2 or HTTP/3 frontends and HTTP/1.1 backends that do not drain the `CONNECT` body on non-2xx responses. The blast radius depends on pool size; with
MaxIdleConnsPerHost=1, 8 out of 8 sequential victims received poisoned responses.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
