Traefik has released v2.11.57, a patch version that brings important bug fixes and security hardening for production environments. Even though it's a minor release, the changes touch core areas like ACME, HTTP/3, and server request handling, making it a worthwhile upgrade for all users.
Here are the concrete fixes included in this release:
[acme] Disable recursive nss propagation by default for DNS challenge ( #13830 @rtribotte ): The DNS challenge now disables recursive NSS propagation by default, preventing certain DNS resolution loops that could cause challenges to fail. This is a behavioral change that may require configuration adjustments if you depend on recursive NSS resolution.
[http3] Dedicate a transport per HTTP/3 client connection ( #13812 @sdelicata ): Each HTTP/3 client connection now gets its own transport instance, fixing potential race conditions and improving connection stability and isolation.
[server] Deny request with an opaque request target ( #13796 @sdelicata ): Requests with an opaque target (e.g.,
*or malformed URIs) are now denied, closing a potential request smuggling vector and aligning with RFC 9110 requirements.[server] Do not forward h2c upgrade headers to the backend ( #13797 @sdelicata ): When handling HTTP/2 cleartext (h2c) upgrades, Traefik no longer forwards the
Upgrade: h2candConnectionheaders to the backend. This prevents confusion and potential protocol errors in the backend.
This release also mentions that users should read the migration guide, especially if they rely on the ACME DNS challenge behavior. For developers operating Traefik, these fixes enhance security and reliability, particularly in multi-tenant or high-traffic environments. The change to deny opaque request targets is essential for preventing HTTP request smuggling, while the HTTP/3 transport improvement ensures smoother performance over QUIC. Upgrading to v2.11.57 is recommended to mitigate these risks.
Source: https://github.com/traefik/traefik/releases/tag/v2.11.57