---
title: "GHSA-5423-jcjm-2gpv: Traefik affected by Go HTTP Request Smuggling Vulnerability"
url: https://erroneo.us/security/ghsa/GHSA-5423-jcjm-2gpv/
description: "GHSA-5423-jcjm-2gpv (critical, Go): Traefik affected by Go HTTP Request Smuggling Vulnerability. Summary net/http: request smuggling through invalid chunked…"
type: advisory
section: "Security Digest"
date_published: 2025-04-18
date_modified: 2025-04-18
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-5423-jcjm-2gpv"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-5423-jcjm-2gpv: Traefik affected by Go HTTP Request Smuggling Vulnerability

## Affected packages

- Go `github.com/traefik/traefik/v2` < 2.11.24 → fixed: 2.11.24
- Go `github.com/traefik/traefik/v3` < 3.3.6 → fixed: 3.3.6
- Go `github.com/traefik/traefik/v3` = 3.4.0-rc1 → fixed: 3.4.0-rc2

## Details

Summary net/http: request smuggling through invalid chunked data: The net/http package accepts data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permit request smuggling. [CVE-2025-22871] Vendor Affected Components: Go: 1.23.x

## Sources

- [GitHub Advisory GHSA-5423-jcjm-2gpv](https://github.com/advisories/GHSA-5423-jcjm-2gpv)
- [github.com](https://github.com/traefik/traefik/security/advisories/GHSA-5423-jcjm-2gpv)
- [nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-22871)
- [github.com](https://github.com/traefik/traefik/releases/tag/v2.11.24)
- [github.com](https://github.com/traefik/traefik/releases/tag/v3.3.6)
- [github.com](https://github.com/traefik/traefik/releases/tag/v3.4.0-rc2)

---
Source page: https://erroneo.us/security/ghsa/GHSA-5423-jcjm-2gpv/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt