C-H4Ck-0

**Name of the Vulnerable Software and Affected Versions** Traefik versions prior to 2.11.52 Traefik versions 3.6.0 through 3.6.22 Traefik versions 3.7.0 through 3.7.6 **Description** An authentication bypass exists in the ReplacePathRegex middleware due to path traversal. When the middleware is configured with a regex that captures user-controlled path segments without a mandatory path separator, it forwards the replaced path to the backend without validating its normalized form. An unauthenticated remote attacker can send a crafted request that produces an un-normalized path, which a backend that normalizes paths may resolve to a protected route, thereby bypassing authentication middleware. **Recommendations** Update to version 2.11.52. Update to version 3.6.23. Update to version 3.7.7.

**Name of the Vulnerable Software and Affected Versions** Podman Desktop versions prior to 1.26.2 **Description** Podman Desktop, a graphical tool for container and Kubernetes development, contains a flaw where an unauthenticated HTTP server can be exploited by network attackers. This allows for denial-of-service conditions through exhaustion of file descriptors and kernel memory, potentially leading to application crashes or a complete host freeze. Verbose error responses reveal internal paths and system details, including usernames on Windows systems, which could aid in further exploitation. The issue is exploitable over the network without authentication or user interaction. **Recommendations** Update to version 1.26.2 or later.