CVE-2024-52003

Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-Prefix header from an untrusted source. This issue has been addressed in versions 2.11.14 and 3.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52003.json",
    "cwe_ids": [
        "CWE-601"
    ]
}

References

Affected packages

Git / github.com/traefik/traefik

Affected ranges

Type

GIT

Repo

https://github.com/traefik/traefik

Events

Introduced

Fixed

8eadfbb9906ddf06d150f1d2f77f278514ed8fff

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.11.14"
        }
    ]
}

Type

GIT

Repo

https://github.com/traefik/traefik

Events

Introduced

d99d2f95e66a28ee8180634dc80fdf13ba68c62a

Fixed

5cfc11fe68f0371f2374bf07f0812b9b537e64c1

Database specific

{
    "versions": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.2.1"
        }
    ]
}