Skip to content
Fencer Intel
critical 9.8

CVE-2024-45410 json

HTTP client can remove the X-Forwarded headers in Traefik

published 2y ago modified 4mo ago also EUVD-2024-2723 , GHSA-62c8-mh53-4cqv , GO-2024-3135

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits
0
none known

Summary

Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it should not be possible to remove or modify these headers. Since the application trusts the value of these headers, security implications might arise, if they can be modified. For HTTP/1.1, however, it was found that some of theses custom headers can indeed be removed and in certain cases manipulated. The attack relies on the HTTP/1.1 behavior, that headers can be defined as hop-by-hop via the HTTP Connection header. This issue has been addressed in release versions 2.11.9 and 3.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Patch / fix

  • go github.com/traefik/traefik/v3 3.1.3
  • go github.com/traefik/traefik/v2 2.11.9
  • go github.com/traefik/traefik 2.11.9
  • traefik traefik 2.11.9, 3.1.3
  • traefik2 openSUSE Tumbleweed 2.11.10-1.1
  • traefik openSUSE Tumbleweed 3.1.4-1.1

opensuse advisories openSUSE-SU-2024:14367-1openSUSE-SU-2024:14365-1

  • traefik Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 3.1.3-r0

alpine advisories ALPINE-CVE-2024-45410

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2024-45410 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-45410 updated cvss 8.6

traefik: HTTP client can manipulate custom HTTP headers that are added by Traefik

  • Red Hat OpenShift Dev Spaces 3 devspaces/udi-rhel9 3.21-6, devspaces/code-rhel9 3.21-5, devspaces/server-rhel9 3.21-11, devspaces/traefik-rhel9 3.21-1, devspaces/udi-base-rhel9 3.21-2, devspaces/configbump-rhel9 3.21-5, +8 more
    fixed: vendor fix RHSA-2025:8244
  • Red Hat OpenShift Dev Spaces devspaces/devspaces-rhel8-operator Red Hat OpenShift GitOps openshift-gitops-1/argo-rollouts-rhel8
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
2y ago

Exploit prediction

1.51% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
go github.com/traefik/traefik/v3
>=3.0.0-beta3, <3.1.3
3.1.3
go github.com/traefik/traefik/v2
<2.11.9
2.11.9
go github.com/traefik/traefik
<2.11.9
all versions
2.11.9

Affected products

  • traefik traefik

Classification

Weakness
  • CWE-345 Insufficient Verification of Data Authenticity
  • CWE-348 Use of Less Trusted Source

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.