Traefik v3.7.13 fixes header sanitization bypass via request trailers

Traefik v3.7.13 addresses a high-severity security issue where entrypoint header-name sanitization could be bypassed via request trailers. According to the GitHub Security Advisory database, affected versions from v3.2.0 through v3.7.12 allowed unauthenticated clients to smuggle sanitized or trusted header names as HTTP/1.1 chunked trailers or HTTP/2 trailers. This bypass occurred because sanitization strategies such as `aliasHeadersStrategy`, `underscoreHeadersStrategy`, and `forwardedHeaders` scanned only `req.Header` and not `req.Trailer`. As a result, the reverse proxy forwarded these trailers to the backend, potentially allowing attackers to influence backend behavior if the backend merged trailers into its header namespace. The fix in v3.7.13 stops forwarding request trailer values to the backend, while still permitting declared trailer names as per RFC 9110 section 6.6.2.

Operators should verify whether their middleware configuration, particularly body-buffering middlewares like `retry` or `buffering`, interacts with trailer handling in a way that could expose backends to this vulnerability. Additionally, users on end-of-life v3.2 through v3.6 lines must upgrade to v3.7.13, as those lines will not receive individual fixes. Traefik v2 users are unaffected, as the issue is specific to the custom reverse proxy introduced in v3.