CVE-2022-23632

Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.6.1, Traefik skips the router transport layer security (TLS) configuration when the host header is a fully qualified domain name (FQDN). For a request, the TLS configuration choice can be different than the router choice, which implies the use of a wrong TLS configuration. When sending a request using FQDN handled by a router configured with a dedicated TLS configuration, the TLS configuration falls back to the default configuration that might not correspond to the configured one. If the CNAME flattening is enabled, the selected TLS configuration is the SNI one and the routing uses the CNAME value, so this can skip the expected TLS configuration. Version 2.6.1 contains a patch for this issue. As a workaround, one may add the FDQN to the host rule. However, there is no workaround if the CNAME flattening is enabled.

• CWE-295

• https://github.com/traefik/traefik/pull/8764Issue Tracking, Patch, Third Party Advisory
• https://github.com/traefik/traefik/releases/tag/v2.6.1Release Notes, Third Party Advisory
• https://github.com/traefik/traefik/security/advisories/GHSA-hrhx-6h34-j5hcPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory
• https://github.com/traefik/traefik/pull/8764Issue Tracking, Patch, Third Party Advisory
• https://github.com/traefik/traefik/releases/tag/v2.6.1Release Notes, Third Party Advisory
• https://github.com/traefik/traefik/security/advisories/GHSA-hrhx-6h34-j5hcPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory

Published

Feb 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23626m1k1o/blog is a lightweight self-hosted facebook-styled PHP …8.8
• CVE-2022-23627ArchiSteamFarm (ASF) is a C# application with primary purpos…6.8
• CVE-2022-23628OPA is an open source, general-purpose policy engine. Under …5.3
• CVE-2022-2363A vulnerability, which was classified as problematic, has be…4.6
• CVE-2022-23630Gradle is a build tool with a focus on build automation and …7.5
• CVE-2022-23631superjson is a program to allow JavaScript expressions to be…9.8
• CVE-2022-23633Action Pack is a framework for handling and responding to we…5.9
• CVE-2022-23634Puma is a Ruby/Rack web server built for parallelism. Prior …5.9
• CVE-2022-23635Istio is an open platform to connect, manage, and secure mic…7.5
• CVE-2022-23636Wasmtime is an open source runtime for WebAssembly & WASI. P…8.1
• CVE-2022-23637K-Box is a web-based application to manage documents, images…5.4
• CVE-2022-23638svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross…6.1