LoginSign Up
← Back to all sparks
T

Traefik

INFRA · APIS
Velocity5.0

Cloud-native reverse proxy and ingress controller with automatic service discovery

traefik.io ↗

Traefik v2.11 ships three CVEs and Kubernetes CRD collision fixes in maintenance-mode patch cycle.

reverse-proxysecuritykuberneteshttp3infrastructure
◆Current state
Traefik v2.11.x is in long-term stable maintenance, releasing bi-weekly patches. Recent work is entirely security-focused (three CVEs in the September 7 release alone: GHSA-qqjf-53cj-pwvv, GHSA-f52w-8j3h-j724, GHSA-w4v4-9rw7-5326) and reliability-focused (Kubernetes CRD name collision prevention, HTTP/3 timeout handling, CONNECT tunnel fixes). No net-new features are arriving on this branch — all active development is in v3.x.
◆Where it's heading
The v2.11 branch will continue receiving CVE backports and stability fixes for the foreseeable future, but the feature roadmap has moved to Traefik v3. The Kubernetes CRD naming collision fixes in v2.11.55 indicate active operator usage surfacing edge cases in large cluster deployments. The security frequency (5+ CVEs in 60 days) suggests either coordinated disclosure or active vulnerability research against this codebase.
◆Prediction
CVE patches will continue arriving at the current pace. Operators needing new capabilities — improved HTTP/3, modern middleware, v3 provider model — will need to migrate; the v2.11 branch offers no path to those features.

◆Recent moves

  1. 9d ago

    v2.11.57: Three CVEs patched, HTTP/3 transport isolation

    Three CVEs patched alongside operational bug fixes: ACME DNS challenge recursive NSS propagation disabled by default, HTTP/3 transport isolation per connection, and opaque request targets now denied by the server. The CVE cluster in a single release suggests coordinated disclosure.

    View source ↗
  2. 20d ago

    v2.11.56

    HTTP/3 gets proper read timeout, idle timeout, and max header byte enforcement — a gap that previously left HTTP/3 connections without the timeout protections that HTTP/1 and HTTP/2 had. A new entry point option handles aliased request header names for backend compatibility. TCP/UDP negative weights now rejected cleanly.

    View source ↗
  3. 28d ago

    v2.11.55

    Four Kubernetes CRD provider fixes address name collision scenarios in large deployments: generated names are now scoped to their parent objects, a safe naming option is added to avoid collisions explicitly, and TLS resource namespace restriction is configurable. These are operational correctness fixes that matter in multi-tenant cluster setups.

    View source ↗
  4. 1mo ago

    v2.11.54

    Dependency maintenance: DataDog tracing library bump, golang.org/x text and net updates, compress library update. One functional fix for cross-namespace service reference validation in the Kubernetes CRD provider.

    View source ↗
  5. 1mo ago

    v2.11.53

    CVE GHSA-3ccp-42pg-hgv6 patched. The CONNECT tunnel handling is corrected — payload now deferred until the backend accepts the tunnel, fixing a server-side pool management bug. grpc bumped to v1.82.1.

    View source ↗
  6. 2mo ago

    v2.11.52

    CVE GHSA-cxjq-mrr5-89rv patched via sanitization of replaced paths in the ReplacePathRegex middleware — a path traversal or injection vector in the middleware layer. The fix is narrow but high-value for deployments using regex path rewriting.

    View source ↗