traefik

v2.11.48 Bugfix

This release fixes issues for SREs watching stability and regressions.

Published 1mo Reverse Proxies & Load Balancers

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

consul docker etcd go kubernetes letsencrypt

+7 more

load-balancing marathon mesos microservice proxy traefik zookeeper

Affected surfaces

breaking_upgrade crypto_tls

Summary

AI summary

Updates https://github.com/traefik/traefik/pull/13291, https://github.com/traefik/traefik/pull/13195, and https://github.com/traefik/traefik/pull/13227 across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Dependency	Low	Bump golang.org/x/net to v0.55.0. Bump golang.org/x/net to v0.55.0. Source: llm_adapter@2026-06-04 Confidence: high	—
Dependency	Low	Bump golang.org/x/crypto to v0.52.0. Bump golang.org/x/crypto to v0.52.0. Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix
Bugfix	Medium	Compute resolved TLS options after applying models. Compute resolved TLS options after applying models. Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	Medium	Add error on Basic Auth build if users list is empty. Add error on Basic Auth build if users list is empty. Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	Medium	Avoid ingress path matcher injection in Kubernetes Ingress handling. Avoid ingress path matcher injection in Kubernetes Ingress handling. Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	Medium	Move snicheck to request context instead of simulated routing. Move snicheck to request context instead of simulated routing. Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	Medium	Reject requests with different paths after StripPrefix and StripPrefixRegex normalisation. Reject requests with different paths after StripPrefix and StripPrefixRegex normalisation. Source: llm_adapter@2026-06-04 Confidence: high	—

Full changelog

Important: Please read the migration guide.

Bug fixes:

[tls] Compute resolved tlsOptions after applying models (#13291 @rtribotte)
[middleware, authentication] Add error on basic auth build if users is empty (#13195 @rtribotte)
[k8s/ingress] Avoid ingress path matcher injection and backport 11d251415 (#13227 @rtribotte)
[server] Move snicheck to ctx instead of simulated routing (#13214 @juliens)
[middleware] Reject requests with different paths after StripPrefix and StripPrefixRegex normalisation (#13215 @rtribotte)
[server] Bump golang.org/x/net to v0.55.0 (#13251 @kevinpollet)
[server] Bump golang.org/x/crypto to v0.52.0 (#13276 @rtribotte)