CVE-2026-29054

[CVE catalog]

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. A remote unauthenticated client can exploit a case sensitivity vulnerability in how Traefik processes HTTP/1.1 requests. By using lowercase tokens in the Connection header, an attacker can bypass security protections, leading to the removal of Traefik-managed forwarded identity headers. This could result in information disclosure or misattribution of client requests. github.com/traefik/traefik: Traefik: Information disclosure due to case-insensitive Connection header processing The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Published

Mar 5, 2026, 4:18:49 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.50% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "github.com/traefik/traefik/v2",
      "ecosystem": "go",
      "fixed_version": "2.11.38"
    },
    {
      "name": "github.com/traefik/traefik/v3",
      "ecosystem": "go",
      "fixed_version": "3.6.9"
    }
  ]
}