Nmengin

**Name of the Vulnerable Software and Affected Versions** Traefik versions prior to 3.6.11 and 3.7.0-ea.2 **Description** Traefik’s Knative provider constructs router rules by incorporating user-provided values into rule expressions without proper sanitization. Specifically, the `rules[].hosts[]` field in Knative configurations is susceptible to host restriction bypass, allowing an attacker to inject malicious host entries (e.g., `tenant.example.com`) || Host(`attacker.com`) and serve attacker-controlled hosts. The `headers[].exact` field also permits rule-syntax injection, leading to unsafe rule construction. This issue poses a significant risk in multi-tenant clusters, potentially enabling unauthorized traffic routing to victim services and exposing cross-tenant traffic. The vulnerability stems from the use of `fmt.Sprintf` with backtick-delimited literals, which allows malicious input containing backticks to terminate literals and inject additional operators into Traefik’s rule language. A proof-of-concept (PoC) demonstrates the injection of host and header rules, bypassing intended routing restrictions. **Recommendations** Upgrade to Traefik version 3.6.11 or 3.7.0-ea.2 to address this issue.

**Name of the Vulnerable Software and Affected Versions** Traefik versions prior to 2.9.10 Traefik versions prior to 2.10.0-rc2 **Description** There is a vulnerability in Go when parsing the HTTP headers, which impacts Traefik. HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This behavior could be exploited to cause a denial of service. **Recommendations** For versions prior to 2.9.10, update to version 2.9.10 or later to resolve the issue. For versions prior to 2.10.0-rc2, update to version 2.10.0-rc2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Traefik versions prior to 2.8.8 Traefik versions prior to 2.9.0-rc5 **Description** There is a potential issue in Traefik managing HTTP/2 connections. A closing HTTP/2 server connection could hang forever because of a subsequent fatal error. This failure mode could be exploited to cause a denial of service. **Recommendations** For versions prior to 2.8.8, update to version 2.8.8 or later. For versions prior to 2.9.0-rc5, update to version 2.9.0-rc5 or later. As a temporary workaround, consider restricting the use of HTTP/2 connections until a patch is applied.