Traefik 3.7.17 stops NTLM headers exhausting proxy memory

Traefik 3.7.17 stops NTLM headers exhausting proxy memory

2 November 2026: Traefik Labs has fixed a high-severity flaw, rated 7.5, that lets a client with no credentials exhaust the memory, file descriptors and backend connections of a Traefik reverse proxy by sending requests that merely claim NTLM or Negotiate authentication. The fixed releases, 3.7.17 and 2.11.61, came out on 30 October, and advisory GHSA-xv5x-242w-7hf7 followed on 2 November.

Not yet independently verified. Traefik's advisories carry no CVE numbers yet, and none reports exploitation. We will update this when it can be confirmed, and remove this note.

The flaw is new, introduced by a fix: only versions 3.7.14 to 3.7.16 and 2.11.58 to 2.11.60 are affected. Traefik 3.6 and earlier v3 lines, and 2.11.57 and earlier, are not.

A fix for one NTLM bug opened another

Traefik's advisory describes the change. From 2.11.58 and 3.7.14, Traefik gives a client connection its own backend transport as soon as a request carries an Authorization header with the NTLM or Negotiate scheme, before any valid credential or challenge from the backend. That transport, its idle backend connection and its goroutines are not released when the client disconnects, and the FastProxy path has the same pattern. Opening many short connections with such a header is enough to drain the process, "regardless of whether NTLM or Kerberos backends are configured". Older versions only dedicated a transport after the backend itself answered with an NTLM or Negotiate challenge.

That earlier change was itself a security fix. On 20 October, releases 3.7.16 and 2.11.60 closed GHSA-hrpp-p4fc-wwf8, in which ForwardAuth shared one connection pool across all clients, so behind an NTLM or Kerberos auth server such as IIS Windows Authentication an unauthenticated client could pick up another user's authenticated identity.

Which line to run now

• Traefik 3.7: upgrade to 3.7.17.
• Traefik 2.11: upgrade to 2.11.61.
• Traefik 3.0 to 3.6: these lines are end of life and stay exposed to the ForwardAuth identity flaw, which will not be fixed on them. Traefik's advice there is to move to a fixed release of 2.11 or 3.7.

The 3.7.17 release notes ask readers to check the migration guide before upgrading, and add an entry-point option to limit how many values a request header may carry.

A month of proxy fixes

This is the fourth Traefik security release since 6 October. Version 3.7.14 fixed nine advisories, including an SNI check that could be skipped over HTTP/2 and forged client certificate headers on the ingress-nginx provider; 3.7.15 fixed a case where the ingress-nginx provider silently turned off mutual TLS for a host, and a data race that could crash the process. Teams that pinned a Traefik image in early October have missed all of them, and the version number is the quickest thing to check.

Company profile on TrustList: Traefik Labs

Related on TrustList:

• Citrix fixes CVSS 9.5 NetScaler SAML flaw; no attacks seen so far

Sources

• Traefik Labs: GHSA-xv5x-242w-7hf7, per-connection backend transport leak from unauthenticated Negotiate/NTLM headers, 2 November 2026
• Traefik: v3.7.17 release, 30 October 2026
• Traefik: v2.11.61 release, 30 October 2026
• Traefik Labs: GHSA-hrpp-p4fc-wwf8, ForwardAuth shared connection pool, 21 October 2026