Starstruk Logo MarkStarstruk

v2.11.51

EricLBuehler/diffusion-rsv2.11.51Jun 30, 2026by github-actions[bot]

AI Summary

Security fixes and bug fixes for ACME, Middleware, and WebUI in the v2.11 line.

Key Highlights

  • Fixes CVE-2026-54763 and CVE-2026-54764
  • Bumps github.com/go-acme/lego/v5
  • Fixes x-forwarded-port in forward-auth
  • Configurable max request header size

New Features

  • Configurable max request header size
  • Option to remove request headers with underscores

Full Release Notes

**Important:** Please read the [migration guide](https://doc.traefik.io/traefik/v2.11/migration/v2/#v21151).

**CVE fixed:**
- [CVE-2026-54763](https://nvd.nist.gov/vuln/detail/CVE-2026-54763) (Advisory [GHSA-x677-9fxg-v5c5](https://github.com/traefik/traefik/security/advisories/GHSA-x677-9fxg-v5c5))
- [CVE-2026-54764](https://nvd.nist.gov/vuln/detail/CVE-2026-54764) (Advisory [GHSA-3q9r-p662-5j8m](https://github.com/traefik/traefik/security/advisories/GHSA-3q9r-p662-5j8m))

**Bug fixes:**
- **[acme]** Bump github.com/go-acme/lego/v5 ([#13359](https://github.com/traefik/traefik/pull/13359) @juliens)
- **[middleware, authentication]** Fix x-forwarded-port in forward-auth ([#13344](https://github.com/traefik/traefik/pull/13344) @juliens)
- **[middleware, authentication]** Add an option to remove request headers with underscores ([#13262](https://github.com/traefik/traefik/pull/13262) @youkoulayley)
- **[webui]** Bump axios to v1.18.0 ([#13380](https://github.com/traefik/traefik/pull/13380) @gndz07)
- Configurable max request header size ([#13353](https://github.com/traefik/traefik/pull/13353) @juliens)

**Documentation:**
- **[security]** Add HTTP/2 header memory exhaustion security documentation ([#13381](https://github.com/traefik/traefik/pull/13381) @emilevauge)
- Adds documentations on maxHeaderBytes ([#13363](https://github.com/traefik/traefik/pull/13363) @juliens)