Traefik allows an unauthenticated client to inject a spoofed header name through HTTP/1.1 chunked trailers or HTTP/2 trailers. The bypass occurs because the entrypoint defenses that sanitize alias, underscore, and forwarded headers only inspect req.Header and not req.Trailer. When the retry or buffering middleware reads the body before the reverse proxy clones the request, the attacker‑provided trailer value is merged into the header namespace and reaches the backend, bypassing the documented delete or reject behavior. This can lead to spoofed identity or forwarded routing data. The flaw represents CWE‑436 (Improper Validation of Serialized Data), CWE‑444 (Improper Validation of Data), and CWE‑807 (Information Exposure Through Duplicate Keys) weaknesses, where the system incorrectly regains control over header names from untrusted input.

Traefik releases from version 3.2.0 up to and including 3.7.12 are affected. The vulnerability was addressed in 3.7.13, so any deployment running an intermediate version in the indicated range is vulnerable.

The CVSS score of 7 indicates a medium severity. The EPSS score is 0.273% and the vulnerability is not listed in CISA KEV, suggesting a lower probability of immediate exploitation. Nevertheless, an attacker can exploit the flaw by sending a crafted request with a malicious trailer, bypassing header sanitization and achieving unauthorized data injection. The risk is elevated when retry or buffering middleware is enabled.