Nmengin

**Name of the Vulnerable Software and Affected Versions** Traefik versions prior to 3.6.11 and 3.7.0-ea.2 **Description** Traefik’s Knative provider constructs router rules by incorporating user-provided values into rule expressions without proper sanitization. Specifically, the `rules[].hosts[]` field in Knative configurations is susceptible to host restriction bypass, allowing an attacker to inject malicious host entries (e.g., `tenant.example.com`) || Host(`attacker.com`) and serve attacker-controlled hosts. The `headers[].exact` field also permits rule-syntax injection, leading to unsafe rule construction. This issue poses a significant risk in multi-tenant clusters, potentially enabling unauthorized traffic routing to victim services and exposing cross-tenant traffic. The vulnerability stems from the use of `fmt.Sprintf` with backtick-delimited literals, which allows malicious input containing backticks to terminate literals and inject additional operators into Traefik’s rule language. A proof-of-concept (PoC) demonstrates the injection of host and header rules, bypassing intended routing restrictions. **Recommendations** Upgrade to Traefik version 3.6.11 or 3.7.0-ea.2 to address this issue.

**Name of the Vulnerable Software and Affected Versions** Traefik versions prior to 2.9.10 Traefik versions prior to 2.10.0-rc2 **Description** There is a vulnerability in Go when parsing the HTTP headers, which impacts Traefik. HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This behavior could be exploited to cause a denial of service. **Recommendations** For versions prior to 2.9.10, update to version 2.9.10 or later to resolve the issue. For versions prior to 2.10.0-rc2, update to version 2.10.0-rc2 or later to resolve the issue.

**Nome do software vulnerável e versões afetadas** Versões do Traefik anteriores à 2.8.8 Versões do Traefik anteriores à 2.9.0-rc5 **Descrição** Existe um problema potencial no Traefik relacionado ao gerenciamento de conexões HTTP/2. O encerramento de uma conexão HTTP/2 com o servidor pode ficar indefinidamente pendente devido a um erro fatal subsequente. Esse modo de falha pode ser explorado para causar uma negação de serviço. **Recomendações** Para versões anteriores à 2.8.8, atualize para a versão 2.8.8 ou posterior. Para versões anteriores à 2.9.0-rc5, atualize para a versão 2.9.0-rc5 ou posterior. Como solução temporária, considere restringir o uso de conexões HTTP/2 até que um patch seja aplicado.