Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
CRITICAL severity

GHSA-5423-jcjm-2gpv v2

CRITICAL

GHSA-5423-jcjm-2gpv is a critical-severity (CVSS 9.1) vulnerability in github.com/traefik/traefik/v2. A fix is available for github.com/traefik/traefik/v2 — see the affected versions and patch details below.

Traefik affected by Go HTTP Request Smuggling Vulnerability

Also known asGO-2025-3627
Published
Apr 18, 2025
Updated
Apr 22, 2025
Affected
3 pkgs
Patched
3 / 3
Exploits
None indexed
Exploitation data as of Apr 22, 2025 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

3 pkgs affected
🐹github.com/traefik/traefik/v2🐹github.com/traefik/traefik/v3🐹github.com/traefik/traefik/v3

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Summary

net/http: request smuggling through invalid chunked data: The net/http package accepts data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permit request smuggling. [CVE-2025-22871] Vendor Affected Components: Go: 1.23.x < 1.23.8

More Details: CVE-2025-22871

Patches

Affected Packages

3 total 3 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/traefik/traefik/v2all versions2.11.24go get github.com/traefik/traefik/v2@v2.11.24
🐹Gogithub.com/traefik/traefik/v3all versions3.3.6go get github.com/traefik/traefik/v3@v3.3.6
🐹Gogithub.com/traefik/traefik/v33.4.0-rc1&&< 3.4.0-rc23.4.0-rc2go get github.com/traefik/traefik/v3@v3.4.0-rc2

Detection & mitigation playbook

Open-source dependency
  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/traefik/traefik/v2, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/traefik/traefik/v2 to 2.11.24 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5423-jcjm-2gpv is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-5423-jcjm-2gpv can be triaged on real exposure rather than presence alone.

Tailored to GHSA-5423-jcjm-2gpv. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Summary net/http: request smuggling through invalid chunked data: The net/http package accepts data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permit request smuggling. [CVE-2025-22871] Vendor Affected Components: Go: 1.23.x < 1.23.8 More Details: [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) ## Patches - https://github.com/traefik/traefik/releases/tag/v2.11.24 - https://g
O3 Security · Impact-Aware SCA

Is GHSA-5423-jcjm-2gpv in your dependencies?

O3 Security finds GHSA-5423-jcjm-2gpv across Go dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.

GHSA-5423-jcjm-2gpv: v2 (Critical 9.1) | O3 Security