High-severity HTTP request smuggling vulnerability in Traefik

Traefik versions v2.11.57 and v3.7.13 have addressed a high-severity vulnerability involving HTTP request smuggling and incorrect authorization, as detailed in the GitHub Security Advisory database. The issue stems from Traefik's handling of the HTTP/1.1 `Upgrade` mechanism when transitioning to unencrypted HTTP/2 with prior knowledge (Go 1.24). Specifically, a client-initiated `Upgrade: h2c` request header and its associated `HTTP2-Settings` header were being forwarded to the backend. If the backend accepted the h2c upgrade and responded with `101 Switching Protocols`, Traefik would switch into a raw byte tunnel, bypassing its routing and middleware chain, including authentication, IPAllowList, and rate limiting. This vulnerability does not affect `Upgrade: websocket` tokens, and common off-the-shelf backend servers were found to be non-exploitable during testing.

Operators should verify whether their backend servers are capable of upgrading h2c requests without validating the `Connection` header listing. If such servers are in use, this vulnerability could expose critical paths to unauthorized access. Additionally, users running end-of-life versions v3.4.2 through v3.6 must upgrade to v3.7.13, as these versions are also affected but no longer supported. Before upgrading, operators should confirm compatibility with middleware configurations and ensure that the patch does not disrupt legitimate `Upgrade` mechanisms in their environment. This advisory highlights a recurring pattern in HTTP proxy systems where improper handling of upgrade headers can lead to bypass vulnerabilities.