{"vulnerability": "cve-2026-71324", "sightings": [{"uuid": "aca6d5fc-0bcd-4926-ba10-1f13da947655", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71324", "type": "seen", "source": "https://gist.github.com/alon710/44f5ca1944b401eb63cfb2fdd265ca45", "content": "# CVE-2026-71324: CVE-2026-71324: Cross-User Response Poisoning in Traefik via HTTP/2 and HTTP/3 CONNECT Handling\n\n> **CVSS Score:** 7.0\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71324\n\n## Summary\nCVE-2026-71324 is a high-severity HTTP request smuggling vulnerability in the Traefik reverse proxy. It allows an unauthenticated remote attacker to achieve cross-user response poisoning when Traefik is configured to route HTTP/2 or HTTP/3 CONNECT requests to an HTTP/1.1 upstream backend. By sending a crafted CONNECT request that is subsequently rejected by the backend with a keep-alive non-2xx response, the attacker can leave smuggled requests within the shared connection pool, which are then served to subsequent clients.\n\n## TL;DR\nAn unauthenticated remote attacker can poison the backend connection pool in Traefik by sending HTTP/2 or HTTP/3 CONNECT requests containing smuggled payloads. When the upstream HTTP/1.1 server rejects the tunnel, unconsumed payload bytes remain in the connection buffer and are served to other users.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-444\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 7.0 (High)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n- **Impact**: Cross-User Response Poisoning\n\n## Affected Systems\n\n- Traefik Proxy (versions < 2.11.53)\n- Traefik Proxy (versions 3.0.0 to 3.6.23)\n- Traefik Proxy (versions 3.7.0 to 3.7.8)\n- **Traefik**: < 2.11.53 (Fixed in: `2.11.53`)\n- **Traefik**: >= 3.0.0, < 3.6.24 (Fixed in: `3.6.24`)\n- **Traefik**: >= 3.7.0, < 3.7.9 (Fixed in: `3.7.9`)\n\n## Mitigation\n\n- Upgrade Traefik to a patched version (2.11.53, 3.6.24, or 3.7.9).\n- Disable HTTP/2 and HTTP/3 on Traefik entrypoints to prevent Extended CONNECT negotiations.\n- Disable 'forwardBody' and 'preserveRequestMethod' in the ForwardAuth middleware configuration.\n- Configure WAF rules to block external client requests that employ the CONNECT method.\n\n**Remediation Steps:**\n1. Identify the current running version of Traefik in your environment.\n2. Download the matching patched release (e.g., v3.7.9 if currently on v3.7.x) from the official repository.\n3. Update deployment manifests or container image references to point to the new version.\n4. Perform a rolling restart of the Traefik proxy instances to apply the changes.\n5. Validate that HTTP/2 and HTTP/3 services function correctly and monitor connection metrics.\n\n## References\n\n- [GHSA-3ccp-42pg-hgv6: Response poisoning via CONNECT requests](https://github.com/traefik/traefik/security/advisories/GHSA-3ccp-42pg-hgv6)\n- [CVE.org Authority Record for CVE-2026-71324](https://www.cve.org/CVERecord?id=CVE-2026-71324)\n- [Traefik v3.7.9 Release Notes](https://github.com/traefik/traefik/releases/tag/v3.7.9)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71324) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T16:31:29.260656Z"}, {"uuid": "cd28d23a-7db0-4024-a5b0-ccec0959d8b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71324", "type": "published-proof-of-concept", "source": "https://github.com/traefik/traefik/security/advisories/GHSA-3ccp-42pg-hgv6", "content": "", "creation_timestamp": "2026-08-06T16:35:02.616191Z"}]}