Traefik 2.11.x prior to 2.11.58 and 3.x prior to 3.7.14 contain a race condition in the NTLM and Kerberos (Negotiate) backend authentication. The per‑connection sticky round tripper slot is read and written without synchronization, allowing an attacker to send concurrent HTTP/2 or HTTP/3 requests over a single connection. This race can orphan backend connections, break connection‑bound authentication, and can lead to a crash of the Traefik process. The attack therefore impacts the integrity of authentication and the availability of the service, but does not provide a direct confidentiality breach.

The vulnerability affects Traefik deployments where NTLM or Kerberos authentication is enabled. All releases in the 2.11.x series before 2.11.58 and the 3.x series before 3.7.14 are impacted. Any Traefik instance handling NTLM/Kerberos requests on HTTP/2 or HTTP/3 is susceptible.

The CVSS score of 6.3 indicates moderate severity. An EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a moderate potential for exploitation. The attack vector is remote, network‑based; a malicious actor can trigger the race by sending concurrent requests over a single connection, without requiring local privilege. Successful exploitation can result in orphaned connections, authentication failures, or a denial‑of‑service condition.