Traefik 3.7.17 fixes a CVSS 7.5 bug: an unauthenticated Negotiate/NTLM header is enough to exhaust backend transports

Traefik shipped 3.7.17 on November 2. Nobody reads patch releases like this one, but it fixes GHSA-xv5x-242w-7hf7: CVSS 7.5, network attack vector, no privileges, no user interaction.

What is rarer is the line under the advisory: “This report was submitted with AI assistance.” First time I have seen that note on a real security advisory.

The shape of the bug

The mechanism is worth spelling out, because its cleverness comes from abusing a normal feature:

1. Since v2.11.58 / v3.7.14, Traefik supports connection-bound auth such as NTLM and Kerberos by dedicating a backend transport up front when it sees an Authorization: NTLM or Negotiate header
2. The precondition is only the presence of that header. No valid credential, no backend challenge required
3. When the client disconnects, that idle backend transport and its goroutines are not released
4. So an anonymous client can open a burst of header-only, immediately-closed connections and steadily consume memory, file descriptors and backend connections

FastProxy has the same pattern. Traefik v3.6 and earlier, and v2.11.57 and earlier, are not affected: they dedicate a transport only after the backend actually answers with a WWW-Authenticate challenge.

Why this class is worth remembering

It is easy to exploit and hard to spot during design. Preparing early for an auth scheme is entirely correct on the happy path. Only “prepared early” plus “never released” turns into a denial of service.

Most of us, when hardening a reverse proxy, look at auth middleware, TLS and header forwarding. Almost nobody reviews “which requests make the proxy allocate resources in advance”. This one adds that lens:

The earlier resources are allocated, the cheaper the attack becomes.

Fix and self-check

Patched versions are 3.7.17 (v3) and 2.11.61 (v2). Two things worth doing alongside the upgrade:

• Block suspicious Authorization headers at the edge. If you do not use NTLM or Kerberos at all, reject those schemes one layer up and the early allocation can never trigger
• Watch backend connection counts. Active connections climbing while request volume stays flat is the classic signal

3.7.17 also bumps lego to v5.6.0, go-jose to v4.1.6 and quic-go to v0.64.1; fixes broken flush, hijack and deadlines in wrapped ResponseWriters; resolves secret references when building middlewares; and adds an entry point option to limit request header values. If you are waiting on 3.8, rc.1 already has per-router responding timeouts, ACME reusePrivateKey and BackendTLSPolicy for TLSRoute.

A closing thought

Writing this up made me think about how much cleverness we delegate to defaults. NTLM support is a good feature: it lets a pile of legacy enterprise apps sit behind a modern proxy. But making it smooth requires the proxy to start preparing the moment it sees a header. The line between smooth and safe usually only becomes visible after something breaks.

And that “AI assisted” tag. I do not read it as a demerit. Someone, or some tool, understood the ordering of resource allocation in the code and described it clearly enough that a patch existed within a week. Every step of that is worth crediting.