{"schema":"threatline.record/2","record":{"id":"GHSA-mhjw-hmjv-p99x","aliases":["GHSA-mhjw-hmjv-p99x"],"summary":"Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/2 streams","details":"## Summary\n\nThere is a medium severity vulnerability in Traefik's NTLM and Kerberos (Negotiate) backend authentication support. When a backend answers a request with a `WWW-Authenticate: NTLM` or `Negotiate` challenge, Traefik stores a dedicated backend round tripper in the client connection context so that the next requests on that client connection reuse the same authenticated backend connection. That per-connection slot was read and written without any synchronization, while HTTP/2 and HTTP/3 client connections multiplex concurrent requests over a single connection. Concurrent requests racing on the slot could replace a round tripper already in use, orphaning the backend connections it held and breaking the connection-bound authentication for that client, and a torn read of the slot may crash the Traefik process.\n\nThe fix guards the slot with a mutex and keeps the round tripper already stored for a client connection, so concurrent requests stick exactly once. The same change also dedicates the slot to the `ServersTransport` that created it, which is tracked separately as GHSA-cw35-4q88-3rmp.\n\nTraefik v3.0 through v3.6 are affected and no longer receive patches; users on those lines must upgrade to v3.7.14. Traefik v2 is affected from v2.11.0, where NTLM and Kerberos support was introduced; earlier v2 releases and Traefik v1 are not affected.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.58\n- https://github.com/traefik/traefik/releases/tag/v3.7.14\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n","categories":["Unclassified"],"product":"github.com/traefik/traefik/v2","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/traefik/traefik/security/advisories/GHSA-mhjw-hmjv-p99x","source_modified_at":"2026-10-07T08:47:54Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"ecosystem":"go","name":"github.com/traefik/traefik/v2"},"range":">= v2.11.0, <= v2.11.57"},{"source":"GitHub Advisory Database","source_url":"https://github.com/traefik/traefik/security/advisories/GHSA-mhjw-hmjv-p99x","source_modified_at":"2026-10-07T08:47:54Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"ecosystem":"go","name":"github.com/traefik/traefik/v3"},"range":">= v3.0.0, <= v3.7.13"}],"fixed_versions":[],"cvss":6.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-07T08:47:54Z","modified_at":"2026-10-07T08:47:54Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/traefik/traefik/security/advisories/GHSA-mhjw-hmjv-p99x","fetched_at":"2026-10-26T19:10:57.178988Z","source_modified_at":"2026-10-07T08:47:54Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-07T08:47:54Z","content_hash":"dcd593fdc319733d63e9babf860d765f2f471c51a1725764cb44ac89181070a1"}}