A 9.8 critical arbitrary execution vulnerability via http requests on Traefik? You'd think we had figured out how to reply to http requests by now
@rune Given their lack of explanation or sources that confirm this, it feels to me like that was an error, to be honest
@joepie91 9.8 cve score seems quite high for header manipulation
@rune Yeah, agreed. But I can't find anything in either the NIST *or* original advisory suggesting it is anything more than that, other than a vague "things might be worse if the server trusts the header"?
@joepie91 yeah, it's either really poorly described or really poorly graded
@joepie91 that's what cert.europa.eu says in their summary