CVE-2021-32813
mediumpriority · track · 32EPSS 0.011 · 65 %ileEUUSEPSS · scored 2026-10-27
Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.4.13, there exists a potential header vulnerability in Traefik's handling of the Connection header. Active exploitation of this issue is unlikely, as it requires that a removed header would lead to a privilege escalation, however, the Traefik team has addressed this issue to prevent any potential abuse. If one has a chain of Traefik middlewares, and one of them sets a request header, then sending a request with a certain Connection header will cause it to be removed before the request is sent. In this case, the backend does not see the request header. A patch is available in version 2.4.13. There are no known workarounds aside from upgrading.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.8–8.1
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (6)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-m697-4v8f-55qgHeader dropping in traefik2021-08-05ghsa · osvUS
# Impact There exists a potential header vulnerability in Traefik's handling of the Connection header. Active exploitation of this issue is unlikely, as it requires that a removed header would lead to a privilege escalation, however, the Traefik team has addressed this issue to prevent any potential abuse. # Details If you have a chain of Traefik middlewares, and one of them sets a request header `Important-Security-Header`, then sending a request with the following Connection header will cause it to be removed before the request was sent: ``` curl 'https://example.com' -H "Connection: Important-Security-Header" -0 ``` In this case, the backend does not see the request header `Important-Security-Header`. # Patches Traefik v2.4.x: https://github.com/traefik/traefik/releases/tag/v2.4.13 # Workarounds No. # For more information If you have any questions or comments about this advisory, [open an issue](https://github.com/traefik/traefik/issues).
- GO-2022-0923Header dropping in traefik in github.com/traefik/traefik2024-08-21vendor · osvUS
Header dropping in traefik in github.com/traefik/traefik
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://github.com/traefik/traefik/pull/8319/commits/cbaf86a93014a969b8accf39301932c17d0d73f9cnnvd
- https://github.com/traefik/traefik/releases/tag/v2.4.13cnnvd
- https://github.com/traefik/traefik/security/advisories/GHSA-m697-4v8f-55qgcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-32813cnnvd
- https://github.com/traefik/traefik/pull/8319/commits/cbaf86a93014a969b8accf39301932c17d0d73f9enisa_euvd
- https://github.com/traefik/traefik/releases/tag/v2.4.13enisa_euvd
- https://github.com/traefik/traefik/security/advisories/GHSA-m697-4v8f-55qgenisa_euvd
- https://github.com/traefik/traefik/pull/8319/commits/cbaf86a93014a969b8accf39301932c17d0d73f9PatchThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan