Traefik is a popular HTTP reverse proxy that inserts client‑identity headers such as X-Real-Ip, X-Forwarded-Host, and X-Forwarded-Port for use by backend services. This vulnerability arises from a case‑sensitivity bug in the handling of the Connection header: the comparison that protects against removal of these headers is case‑sensitive, yet the actual deletion operation treats the header case‑insensitively. As a result, an unauthenticated HTTP/1.1 client can send a Connection header with a lowercase token (for example, Connection: x-real-ip) and cause Traefik to strip the corresponding forwarded identity header. The loss of these headers can undermine authentication, rate‑limiting, logging, and profiling mechanisms on downstream services, potentially enabling spoofing of client identity or denial of service conditions that rely on accurate header data.

The flaw affects Traefik version 2.11.9 through 2.11.37 and 3.1.3 through 3.6.8. Clients that use HTTP/1.1 to communicate with any of these releases may trigger the header deletion logic.

The CVSS v3.1 score is 7.5, indicating a high severity. The EPSS score is below 1%, implying exploitation is not widely observed. The vulnerability is not currently listed in the CISA KEV catalog. A remote attacker can exploit the flaw via a simple HTTP request; no authentication or privileged access is required, and the attack vector is network‑based, sending a crafted Connection header.