Traefik Labs Traefik 3.4.0 Release Candidate 1

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:traefik:traefik:3.4.0:rc1:*:*:*:*:*:*

part: a version: 3.4.0 update: rc1

VendorTraefik (b040e15c-504b-5a80-9734-acb4a8f65c42)
ProductTraefik (78ce5f4f-6774-5086-a6e8-adb1ce31de4e)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:github/traefik/traefik purl2cpe 2026-06-01 10:17:28.802123
pkg:rpm/opensuse/traefik purl2cpe 2026-06-01 10:17:28.802125
pkg:sourceforge/traefik.mirror purl2cpe 2026-06-01 10:17:28.802126

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-32431 vulnerable 2026-06-08 07:18:59.753216 Traefik has a possible vulnerability with the path matchers
Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. In versions prior to 2.11.24, 3.3.6, and 3.4.0-rc2. There is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backend using a matcher based on the path, if the URL contains a /../ in its path, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain. This issue has been patched in versions 2.11.24, 3.3.6, and 3.4.0-rc2. A workaround involves adding a `PathRegexp` rule to the matcher to prevent matching a route with a `/../` in the path.
Published: 2025-04-21T15:34:04.637Z
Updated: 2025-04-21T15:55:15.087Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.