CVE-2026-114641

LowCVSS 3.7/10Last modified Oct 22, 2026

Description

Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send concurrent HTTP/2 or HTTP/3 requests over one connection to orphan backend connections, break connection-bound authentication, or crash Traefik.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-362

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
traefiktraefik>= 2.11.0, < 2.11.58
traefiktraefik>= 3.0.0, < 3.7.14

References

Timeline

Published
Oct 22, 2026
Last modified
Oct 22, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-1146428.7Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed bCVE-2026-1146435.4The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type aCVE-2026-1146445.9The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON valuCVE-2026-1146455.2A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to CVE-2026-1146466.5A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a CVE-2026-1146474.3The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlikCVE-2026-1146487.6The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINCVE-2026-1146496.8The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached cCVE-2026-114653.1A security flaw has been discovered in songquanpeng one-api up to 0.6.11-preview.7. Affected by this issue is the function Redeem of the filCVE-2026-1146505.9A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption CVE-2026-1146514.0A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processedCVE-2026-1146526.5A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-sup