Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Traefik: oauth2/jws library validation issue

published 1 year ago
Summary

Traefik's oauth2/jws library does not properly check user input, which could allow attackers to manipulate data. This could lead to unauthorized access or other security risks. To fix this issue, update to version 2.11.24 or later of Traefik 2, or version 3.3.6 or later of Traefik 3.

What to do
  • Update github.com traefik to version 3.3.6.
  • Update github.com traefik to version 2.11.24.
  • Update github.com traefik to version 3.4.0-rc2.
Affected software
Ecosystem VendorProductAffected versions
go github.com traefik < 3.3.6
3.4.0-rc1
Fix: upgrade to 3.3.6
go github.com traefik < 2.11.24
Fix: upgrade to 2.11.24
Original advisory text
Traefik affected by Go oauth2/jws Improper Validation of Syntactic Correctness of Input vulnerability
### Summary
We have encountered a security vulnerability being reported by our scanners for Traefik 2.11.22.
- https://security.snyk.io/vuln/SNYK-CHAINGUARDLATEST-TRAEFIK33-9403297

### Details
It seems to target oauth2/jws library.

### PoC
No steps to replicate this vulnerability

### Impact
We have a strict control on security and we always try to stay up-to-date with the fixes received for third-party solutions.

## Patches

- https://github.com/traefik/traefik/releases/tag/v2.11.24
- https://github.com/traefik/traefik/releases/tag/v3.3.6
- https://github.com/traefik/traefik/releases/tag/v3.4.0-rc2
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Type
CWE-1286Improper Validation of Syntactic Correctness of Input
Timeline
Published18 Apr 2025
Updated13 Mar 2026
First seen6 Mar 2026
Sources
GHSA-3wqc-mwfx-672p · GHSA
Track software like this
Free during beta