GHSA-3wqc-mwfx-672p Traefik affected by Go oauth2/jws Improper Validation of Syntactic Correctness of Input vulnerability

Not scored Published 18 Apr 2025

Traefik is vulnerable to improper input validation in its OAuth2/JWS library, potentially allowing security bypasses; users should upgrade to patched versions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-3wqc-mwfx-672p?

GHSA-3wqc-mwfx-672p is a vulnerability in github.com/traefik/traefik/v2, published on 18 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Summary

We have encountered a security vulnerability being reported by our scanners for Traefik 2.11.22.

https://security.snyk.io/vuln/SNYK-CHAINGUARDLATEST-TRAEFIK33-9403297

Details

It seems to target oauth2/jws library.

PoC

No steps to replicate this vulnerability

Impact

We have a strict control on security and we always try to stay up-to-date with the fixes received for third-party solutions.

Patches

Which versions are affected by GHSA-3wqc-mwfx-672p?

6 open source packages ship an affected version, including github.com/traefik/traefik/v2 and github.com/traefik/traefik/v3.

Package	Affected	Fixed in
`github.com/traefik/traefik/v2` Go	All versions	`2.11.24`
`github.com/traefik/traefik/v2` Go	All versions	`2.11.24`
`github.com/traefik/traefik/v3` Go	All versions	`3.3.6`
`github.com/traefik/traefik/v3` Go	All versions	`3.3.6`
`github.com/traefik/traefik/v3` Go	From `3.4.0-rc1`	`3.4.0-rc2`
`github.com/traefik/traefik/v3` Go	From `3.4.0-rc1`	`3.4.0-rc2`

How do I fix GHSA-3wqc-mwfx-672p?

Upgrade github.com/traefik/traefik/v2 to 2.11.24 or later.

Is GHSA-3wqc-mwfx-672p being exploited?

There is no known exploitation of GHSA-3wqc-mwfx-672p in the wild and no public exploit code.