v2.11.57

JackismyShephard/ultimate-rvcv2.11.57Sep 4, 2026by github-actions[bot]

Upgrading?

AI Summary

A patch release focusing on security fixes and specific bug corrections regarding ACME challenges, HTTP/3, and request handling.

Key Highlights

  • Fixes specific CVEs (GHSA-qqjf-53cj-pwvv, GHSA-f52w-8j3h-j724, etc.)
  • Disable recursive nss propagation by default for DNS challenge
  • Dedicate a transport per HTTP/3 client connection
  • Deny request with an opaque request target

New Features

  • DNS challenge propagation fix
  • HTTP/3 transport improvement
  • Opaque request target denial
  • Do not forward h2c upgrade headers to the backend

Full Release Notes

**Important:** Please read the [migration guide](https://doc.traefik.io/traefik/v2.11/migration/v2/#v21157).

**CVE fixed:**
- Advisory [GHSA-qqjf-53cj-pwvv](https://github.com/traefik/traefik/security/advisories/GHSA-qqjf-53cj-pwvv)
- Advisory [GHSA-f52w-8j3h-j724](https://github.com/traefik/traefik/security/advisories/GHSA-f52w-8j3h-j724)
- Advisory [GHSA-w4v4-9rw7-5326](https://github.com/traefik/traefik/security/advisories/GHSA-w4v4-9rw7-5326)

**Bug fixes:**
- **[acme]** Disable recursive nss propagation by default for DNS challenge ([#13830](https://github.com/traefik/traefik/pull/13830) @rtribotte)
- **[http3]** Dedicate a transport per HTTP/3 client connection ([#13812](https://github.com/traefik/traefik/pull/13812) @sdelicata)
- **[server]** Deny request with an opaque request target ([#13796](https://github.com/traefik/traefik/pull/13796) @sdelicata)
- **[server]** Do not forward h2c upgrade headers to the backend ([#13797](https://github.com/traefik/traefik/pull/13797) @sdelicata)

Related Repositories