HIGH: github.com/traefik/traefik/v2 — Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool
Summary There is a critical vulnerability in Traefik's default HTTP reverse proxy that leads to unauthenticated cross-user response poisoning. When a client opens an HTTP/2 or HTTP/3 CONNECT request, Traefik forwards it — body included — to an HTTP/1.1…
Source github.com/traefik/traefik/v2Published 9d ago · Aug 6, 2026Posted on Threads
What we hold
- Package
- github.com/traefik/traefik/v2
- Ecosystem
- go
- Severity
- HIGH
- ID
- CVE-2026-71324
Summary There is a critical vulnerability in Traefik's default HTTP reverse proxy that leads to unauthenticated cross-user response poisoning. When a client opens an HTTP/2 or HTTP/3 CONNECT request, Traefik forwards it — body included — to an HTTP/1.1…
Learning about advisories like this one the day they are published is a separate problem from reading them here. Dependabot alerts, the GitHub Advisory Database API, OSV.dev and npm audit, compared against live responses: how to get an alert when a dependency has a new security advisory.
More like this
HIGH: org.openidentityplatform.openam:openam-core — OpenAM Insecure SSO Cookie Initialization
Summary Description An Insecure Default Initialization of Resource (CWE-1188) issue in the OpenAM default configuration ships the iPlanetDirectoryPro SSO cookie with HttpOnly=false. Also, the iPlanetDirectoryPro SSO cookie is used as a CSRF token in…
HIGH: ansible-jailexec — Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)
Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host ( + ) and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside…
CRITICAL: codeigniter4/framework — CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules
Impact This is an unsafe file upload validation vulnerability that can lead to remote code execution in vulnerable application configurations. Applications are impacted when they: - validate uploads using isimage or mimein without an independent safe…