GHSA-3wqc-mwfx-672p

Suggest an improvement
Source
https://github.com/advisories/GHSA-3wqc-mwfx-672p
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-3wqc-mwfx-672p/GHSA-3wqc-mwfx-672p.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-3wqc-mwfx-672p
Downstream
MINI (2)
Published
2025-04-18T19:32:23Z
Modified
2026-08-24T00:36:02Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Traefik affected by Go oauth2/jws Improper Validation of Syntactic Correctness of Input vulnerability
Details

Summary

We have encountered a security vulnerability being reported by our scanners for Traefik 2.11.22.

Details

It seems to target oauth2/jws library.

PoC

No steps to replicate this vulnerability

Impact

We have a strict control on security and we always try to stay up-to-date with the fixes received for third-party solutions.

Patches

Database specific 
{
    "cwe_ids":  [
        "CWE-1286"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-04-18T19:32:23Z",
    "nvd_published_at":  "2025-02-26T08:14:24Z",
    "severity":  "HIGH"
}
References

Affected packages

Go / github.com/traefik/traefik/v3

Package

Name
github.com/traefik/traefik/v3
View open source insights on deps.dev
Purl
pkg:golang/github.com/traefik/traefik/v3

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.3.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-3wqc-mwfx-672p/GHSA-3wqc-mwfx-672p.json"

Go / github.com/traefik/traefik/v2

Package

Name
github.com/traefik/traefik/v2
View open source insights on deps.dev
Purl
pkg:golang/github.com/traefik/traefik/v2

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.11.24

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-3wqc-mwfx-672p/GHSA-3wqc-mwfx-672p.json"

Go / github.com/traefik/traefik/v3

Package

Name
github.com/traefik/traefik/v3
View open source insights on deps.dev
Purl
pkg:golang/github.com/traefik/traefik/v3

Affected ranges

Type
SEMVER
Events
Introduced
3.4.0-rc1
Fixed
3.4.0-rc2

Affected versions

3.*
3.4.0-rc1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-3wqc-mwfx-672p/GHSA-3wqc-mwfx-672p.json"