GHSA-7jmw-8259-q9jx
Traefik has unexpected behavior with IPv4-mapped IPv6 addresses
GHSA-7jmw-8259-q9jx is a vulnerability with no CVSS score yet in github.com/traefik/traefik, published June 11, 2024. No source lists public exploit code. Fixed in github.com/traefik/traefik/v3 3.0.2.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.0.2github.com/traefik/traefik/v3 +3 more
Description
Impact
There is a vulnerability in Go managing various Is methods (IsPrivate, IsLoopback, etc) for IPv4-mapped IPv6 addresses.
They didn't work as expected returning false for addresses which would return true in their traditional IPv4 forms.
References
Patches
- https://github.com/traefik/traefik/releases/tag/v2.11.4
- https://github.com/traefik/traefik/releases/tag/v3.0.2
Workarounds
No workaround.
For more information
If you have any questions or comments about this advisory, please open an issue.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/traefik/traefik/v3Go | 3.0.0-beta3 up to 3.0.2 | 3.0.2 |
github.com/traefik/traefik/v2Go | before 2.11.4 | 2.11.4 |
github.com/traefik/traefikGo | before 2.11.4 | 2.11.4 |
github.com/traefik/traefikGo | All versions | None known |
What each source reports
GitHub AdvisoriesNo score
Traefik has unexpected behavior with IPv4-mapped IPv6 addresses
Impact
There is a vulnerability in Go managing various Is methods (IsPrivate, IsLoopback, etc) for IPv4-mapped IPv6 addresses.
They didn't work as expected returning false for addresses which would return true in their traditional IPv4 forms.
References
Patches
- https://github.com/traefik/traefik/releases/tag/v2.11.4
- https://github.com/traefik/traefik/releases/tag/v3.0.2
Workarounds
No workaround.
For more information
If you have any questions or comments about this advisory, please open an issue.
- Record
GHSA-7jmw-8259-q9jx- Weakness
- CWE-180
- Updated
- 2026-11-02
OSVNo score
Traefik has unexpected behavior with IPv4-mapped IPv6 addresses
Impact
There is a vulnerability in Go managing various Is methods (IsPrivate, IsLoopback, etc) for IPv4-mapped IPv6 addresses.
They didn't work as expected returning false for addresses which would return true in their traditional IPv4 forms.
References
Patches
- https://github.com/traefik/traefik/releases/tag/v2.11.4
- https://github.com/traefik/traefik/releases/tag/v3.0.2
Workarounds
No workaround.
For more information
If you have any questions or comments about this advisory, please open an issue.
- Record
GHSA-7jmw-8259-q9jx- Weakness
- CWE-180
- Updated
- 2026-11-02
OSVGO-2024-2917No score
Traefik has unexpected behavior with IPv4-mapped IPv6 addresses in github.com/traefik/traefik
Traefik has unexpected behavior with IPv4-mapped IPv6 addresses in github.com/traefik/traefik
- Record
GO-2024-2917- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.