Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts in github.com/traefik/traefik
Traefik's HTTP/3 TLS configuration selection is vulnerable to a bypass when using wildcard or mixed-case hosts in the SNI. The HTTP/3 (QUIC) path performed a direct, case-sensitive lookup on the SNI value to select the applicable TLS configuration. This lookup failed to match wildcard host patterns (e.g., "*.example.com") or case variants of configured hostnames. In these cases, Traefik would fall back to the default TLS configuration, which might not enforce mutual TLS (mTLS), allowing unauthenticated clients to access protected backends.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-53622US | critical10.0OT elevated | — | ||
Traefik is an HTTP reverse proxy and load balancer. Versions prior to 3.7.3, 3.6.18, and 2.11.51 have a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selectio… | ||||
references
External citations — patches, advisories, analysis.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan