7.5

GHSA-3WQC-MWFX-672P: v2 Go

Published
Published 18-04-2025Last modified 10-09-2026

Vulnerability summary

GHSA-3WQC-MWFX-672P is a high (CVSS 7.5) vulnerability in v2 Go.

Priority
Prioritisesevere

Severe, CVSS 7.5 (OSV · Go); no exploitation reported by the 5 checked sources; EPSS not yet published

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (OSV · Go), selected by version preference
EPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 20
CGA-2485-6HQM-5WXXCGA-2F7P-4WHP-HXC7CGA-2X7R-259C-XJH3CGA-3484-M6G9-XPQWCGA-45QP-MQQV-2C8CCGA-69RG-J45V-62WJ

Timeline

  1. 18-04-2025
    PublishedVulnerability first disclosed.
  2. 10-09-2026
    Last modifiedVulnerability information updated.

Description

Traefik affected by Go oauth2/jws Improper Validation of Syntactic Correctness of Input vulnerability ### Summary We have encountered a security vulnerability being reported by our scanners for Traefik 2.11.22. - https://security.snyk.io/vuln/SNYK-CHAINGUARDLATEST-TRAEFIK33-9403297 ### Details It seems to target oauth2/jws library. ### PoC No steps to replicate this vulnerability ### Impact We have a strict control on security and we always try to stay up-to-date with the fixes received for third-party solutions. ## Patches - https://github.com/traefik/traefik/releases/tag/v2.11.24 - https://github.com/traefik/traefik/releases/tag/v3.3.6 - https://github.com/traefik/traefik/releases/tag/v3.4.0-rc2

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Github.com/traefik/traefik2 products
  • v2< 2.11.24
  • v3< 3.3.6 | ≥ 3.4.0-rc1, < 3.4.0-rc2

1 vendor · 2 products

References

6 links