traefik

v3.7.3 Feature

This release adds 2 notable features for engineering teams evaluating rollout.

Published 1mo Reverse Proxies & Load Balancers

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

consul docker etcd go kubernetes letsencrypt

+7 more

load-balancing marathon mesos microservice proxy traefik zookeeper

Affected surfaces

auth crypto_tls

Summary

AI summary

Broad release touches https://github.com/traefik/traefik/pull/13291, https://github.com/traefik/traefik/pull/13155, https://github.com/traefik/traefik/pull/13203, and https://github.com/traefik/traefik/pull/13180.

Changes in this release

Type	Severity	Summary	CVE
Feature	Low	Change default values and expose configuration for Kubernetes client QPS and Burst in K8s GatewayAPI component. Change default values and expose configuration for Kubernetes client QPS and Burst in K8s GatewayAPI component. Source: granite4.1:30b@2026-06-04-audit Confidence: low	—
Dependency
Dependency	Low	Bump github.com/moby/spdystream to v0.5.1 in K8s GatewayAPI component. Bump github.com/moby/spdystream to v0.5.1 in K8s GatewayAPI component. Source: llm_adapter@2026-06-04 Confidence: high	—
Dependency	Low	Bump github.com/bytedance/sonic to v1.15.1 in server component. Bump github.com/bytedance/sonic to v1.15.1 in server component. Source: llm_adapter@2026-06-04 Confidence: high	—
Dependency	Low	Bump golang.org/x/net to v0.55.0 in server component. Bump golang.org/x/net to v0.55.0 in server component. Source: llm_adapter@2026-06-04 Confidence: high	—
Dependency	Low	Bump golang.org/x/crypto to v0.52.0 in server component. Bump golang.org/x/crypto to v0.52.0 in server component. Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix
Bugfix	Medium	Compute resolved TLS options after applying models. Compute resolved TLS options after applying models. Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	Medium	Fix TCP router service resolution in dashboard flow diagram. Fix TCP router service resolution in dashboard flow diagram. Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	Medium	Trim quotes from proxy_set_header header name in Kubernetes Ingress‑NGINX integration. Trim quotes from proxy_set_header header name in Kubernetes Ingress‑NGINX integration. Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	Medium	Escape double quotes in quoted access‑log fields. Escape double quotes in quoted access‑log fields. Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	Medium	Allow dropping query parameters from RequestPath in access logs. Allow dropping query parameters from RequestPath in access logs. Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	Medium	Clear Ssl‑Client‑* headers when no client certificate is present in K8s Ingress‑NGINX integration. Clear Ssl‑Client‑* headers when no client certificate is present in K8s Ingress‑NGINX integration. Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	Low	Escape exact gRPC method matches in K8s GatewayAPI integration. Escape exact gRPC method matches in K8s GatewayAPI integration. Source: granite4.1:30b@2026-06-04-audit Confidence: low	—
Bugfix	Low	Improve file provider behavior regarding dangling symlinks. Improve file provider behavior regarding dangling symlinks. Source: granite4.1:30b@2026-06-04-audit Confidence: low	—
Bugfix	Low	Move snicheck to context instead of simulated routing in server component. Move snicheck to context instead of simulated routing in server component. Source: granite4.1:30b@2026-06-04-audit Confidence: low	—
Bugfix	Low	Reject requests with different paths after StripPrefix/StripPrefixRegex normalisation in middleware. Reject requests with different paths after StripPrefix/StripPrefixRegex normalisation in middleware. Source: granite4.1:30b@2026-06-04-audit Confidence: low	—
Bugfix	Low	Add error on basic auth build if users list is empty. Add error on basic auth build if users list is empty. Source: granite4.1:30b@2026-06-04-audit Confidence: low	—
Bugfix	Low	Avoid ingress path matcher injection and backport commit 11d251415 in K8s Ingress integration. Avoid ingress path matcher injection and backport commit 11d251415 in K8s Ingress integration. Source: granite4.1:30b@2026-06-04-audit Confidence: low	—

Full changelog

Important: Please read the migration guide.

Bug fixes:

[tls] Compute resolved tlsOptions after applying models (#13291 @rtribotte)
[webui, tcp] Fix TCP router service resolution in dashboard flow diagram (#13155 @aliamerj)
[k8s/ingress-nginx] Trim quotes from proxy_set_header header name (#13203 @crisbal)
[accesslogs] Escape double quotes in quoted log fields (#13180 @KaanSimsek)
[k8s/gatewayapi] Escape exact gRPC method matches (#13201 @nickmnt)
[logs, middleware] Allow query parameters to be dropped from RequestPath in access log (#13091 @calinelson)
[k8s/ingress-nginx] Clear Ssl-Client-* headers when no client certificate is present (#13260 @gndz07)
[k8s/gatewayapi] Bump github.com/moby/spdystream to v0.5.1 (#13252 @kevinpollet)
[file] Improve file provider behavior regarding dangling symlinks (#12449 @fh-yuxiao-zeng)
[server] Bump github.com/bytedance/sonic to v1.15.1 (#13254 @kevinpollet)
[middleware, authentication] Add error on basic auth build if users is empty (#13195 @rtribotte)
[k8s/ingress] Avoid ingress path matcher injection and backport 11d251415 (#13227 @rtribotte)
[server] Move snicheck to ctx instead of simulated routing (#13214 @juliens)
[middleware] Reject requests with different paths after StripPrefix and StripPrefixRegex normalisation (#13215 @rtribotte)
[server] Bump golang.org/x/net to v0.55.0 (#13251 @kevinpollet)
[k8s/gatewayapi] Change default values and expose configuration for Kubernetes client QPS and Burst (#13277 @kevinpollet)
[server] Bump golang.org/x/crypto to v0.52.0 (#13276 @rtribotte)

Documentation:

[k8s] Document new chart behavior on Gateway API (#13167 @mloiseleur)
[file] Replace generated File routing reference page (#13170 @sheddy-traefik)
[k8s/crd] Fix typo in accesslogs field name (#13177 @PlayMTL)
[k8s/ingress-nginx] Surface the Ingress status race condition during NGINX coexistence (#13205 @emilevauge)
Polish grammar in migration guides (#13174 @quyentonndbs)
[middleware] Remove whitespace in HTML tag (#13160 @marbon87)
Add @LBF38 as a current maintainer (#13225 @emilevauge)
Add ingressClassName to Kubernetes CRD provider migration guide (#13248 @kevinpollet)
[k8s/ingress-nginx] Add nginx.ingress.kubernetes.io/enable-global-auth to the list of supported annotations (#13219 @filip2mac)
[k8s/ingress-nginx] Capitalize NGINX in kubernetesIngressNGINX (#13236 @smellems)