---
id: GHSA-3wqc-mwfx-672p
title: >-
  Traefik affected by Go oauth2/jws Improper Validation of Syntactic Correctness
  of Input vulnerability
summary: >-
  Traefik affected by Go oauth2/jws Improper Validation of Syntactic Correctness
  of Input vulnerability
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: traefik
product: github.com/traefik/traefik/v3
ecosystem: go
affected:
  - github.com/traefik/traefik/v3 < 3.3.6
  - github.com/traefik/traefik/v2 < 2.11.24
  - 'github.com/traefik/traefik/v3 >= 3.4.0-rc1, < 3.4.0-rc2'
patched:
  - github.com/traefik/traefik/v3 3.3.6
  - github.com/traefik/traefik/v2 2.11.24
  - github.com/traefik/traefik/v3 3.4.0-rc2
published: '2025-04-18'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:56.941519741Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-3wqc-mwfx-672p'
references:
  - url: 'https://github.com/traefik/traefik/security/advisories/GHSA-3wqc-mwfx-672p'
  - url: 'https://github.com/traefik/traefik'
  - url: 'https://github.com/traefik/traefik/releases/tag/v2.11.24'
  - url: 'https://github.com/traefik/traefik/releases/tag/v3.3.6'
  - url: 'https://github.com/traefik/traefik/releases/tag/v3.4.0-rc2'
  - url: 'https://security.snyk.io/vuln/SNYK-CHAINGUARDLATEST-TRAEFIK33-9403297'
tags:
  - osv
  - go
ingestedAt: '2026-09-12T03:13:01.750Z'
---

## Overview

### Summary
We have encountered a security vulnerability being reported by our scanners for Traefik 2.11.22.
- https://security.snyk.io/vuln/SNYK-CHAINGUARDLATEST-TRAEFIK33-9403297

### Details
It seems to target oauth2/jws library.

### PoC
No steps to replicate this vulnerability

### Impact
We have a strict control on security and we always try to stay up-to-date with the fixes received for third-party solutions.

## Patches

- https://github.com/traefik/traefik/releases/tag/v2.11.24
- https://github.com/traefik/traefik/releases/tag/v3.3.6
- https://github.com/traefik/traefik/releases/tag/v3.4.0-rc2

## Affected packages

- `github.com/traefik/traefik/v3 < 3.3.6`
- `github.com/traefik/traefik/v2 < 2.11.24`
- `github.com/traefik/traefik/v3 >= 3.4.0-rc1, < 3.4.0-rc2`

## Remediation

Upgrade to a patched release:

- `github.com/traefik/traefik/v3 3.3.6`
- `github.com/traefik/traefik/v2 2.11.24`
- `github.com/traefik/traefik/v3 3.4.0-rc2`