v2.11.56

VectifyAI/PageIndexv2.11.56Aug 26, 2026by github-actions[bot]

AI Summary

A maintenance release for v2.11 addressing specific security vulnerabilities and refining HTTP/3 behavior, server header handling, and service weight validation.

Key Highlights

Fixes CVEs GHSA-7ghq-v6jf-g56c and GHSA-rf44-j88r-hh8c
Applies HTTP/3 timeouts and max header bytes configuration
Adds an entry point option to handle request headers with aliasing names
Rejects negative weights in TCP and UDP weighted services
Bumps etcd client modules to v3.5.33

New Features

Entry point option to handle request headers with aliasing names

Full Release Notes

**Important:** Please read the [migration guide](https://doc.traefik.io/traefik/v2.11/migration/v2/#v21156).

**CVE fixed:**
- Advisory [GHSA-7ghq-v6jf-g56c](https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c)
- Advisory [GHSA-rf44-j88r-hh8c](https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c)

**Bug fixes:**
- **[http3]** Apply read timeout, idle timeout, and max header bytes for HTTP/3 ([#13717](https://github.com/traefik/traefik/pull/13717) @gndz07)
- **[server]** Add an entry point option to handle request headers with aliasing names ([#13720](https://github.com/traefik/traefik/pull/13720) @rtribotte)
- **[tcp, udp]** Reject negative weights in TCP and UDP weighted services ([#13749](https://github.com/traefik/traefik/pull/13749) @rtribotte)
- Bump etcd client modules to v3.5.33 ([#13756](https://github.com/traefik/traefik/pull/13756) @mmatur)