Traefik versions v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11 have a header canonicalization issue where headers with dots, underscores, and dashes are treated as distinct. This allows an attacker to smuggle alternate forms of headers past Traefik's middleware, potentially causing backend services to use attacker-supplied header values instead of those asserted by Traefik. This can lead to privilege escalation or identity spoofing. The issue is fixed in v2.11.56 and v3.7.12 with a new configuration option that must be explicitly enabled to take effect. Unmaintained versions will not receive patches.