发布日期: 2026-06-04
版本号: v3.6.19

Traefik发布了v3.6.19版本更新，修复了一个安全漏洞CVE-2026-48020，并包含多项错误修复与文档改进。修复内容涵盖TLS选项计算、访问日志字段转义、Gateway API匹配、文件提供者行为优化、基础认证错误处理、Ingress路径匹配以及多项依赖库升级等。文档方面修正了拼写错误，改进了语法表述，并更新了相关参考页面。

更新内容 （中文）

重要： 请阅读迁移指南。

漏洞修复：

错误修复：

  • [tls] 应用模型后计算已解析的tlsOptions (#13291 @rtribotte)
  • [accesslogs] 转义带引号的日志字段中的双引号 (#13180 @KaanSimsek)
  • [k8s/gatewayapi] 转义精确的gRPC方法匹配 (#13201 @nickmnt)
  • [logs, middleware] 允许在访问日志中从RequestPath丢弃查询参数 (#13091 @calinelson)
  • [k8s/gatewayapi] 将github.com/moby/spdystream升级至v0.5.1 (#13252 @kevinpollet)
  • [file] 改善文件提供程序对悬空符号链接的处理行为 (#12449 @fh-yuxiao-zeng)
  • [server] 将github.com/bytedance/sonic升级至v1.15.1 (#13254 @kevinpollet)
  • [middleware, authentication] 在基本认证构建时如果用户列表为空则添加错误 (#13195 @rtribotte)
  • [k8s/ingress] 避免Ingress路径匹配器注入并回溯提交11d251415 (#13227 @rtribotte)
  • [server] 将SNI检查移至上下文而非模拟路由 (#13214 @juliens)
  • [middleware] 在StripPrefix和StripPrefixRegex规范化后，拒绝路径不同的请求 (#13215 @rtribotte)
  • [server] 将golang.org/x/net升级至v0.55.0 (#13251 @kevinpollet)
  • [k8s/gatewayapi] 更改默认值并暴露Kubernetes客户端QPS和突发量的配置 (#13277 @kevinpollet)
  • [server] 将golang.org/x/crypto升级至v0.52.0 (#13276 @rtribotte)

文档：

  • [file] 替换生成的File路由参考页面 (#13170 @sheddy-traefik)
  • [k8s/crd] 修复accesslogs字段名拼写错误 (#13177 @PlayMTL)
  • [k8s/ingress-nginx] 阐述与NGINX共存期间的Ingress状态竞争条件 (#13205 @emilevauge)
  • 润色迁移指南语法 (#13174 @quyentonndbs)
  • [middleware] 移除HTML标签中的空白 (#13160 @marbon87)
  • 添加@LBF38为当前维护者 (#13225 @emilevauge)
  • [k8s/ingress-nginx] 将kubernetesIngressNGINX中的NGINX大写 (#13236 @smellems)

更新内容 （原始）

Important: Please read the migration guide.

CVE fixed:

Bug fixes:

  • [tls] Compute resolved tlsOptions after applying models (#13291 @rtribotte)
  • [accesslogs] Escape double quotes in quoted log fields (#13180 @KaanSimsek)
  • [k8s/gatewayapi] Escape exact gRPC method matches (#13201 @nickmnt)
  • [logs, middleware] Allow query parameters to be dropped from RequestPath in access log (#13091 @calinelson)
  • [k8s/gatewayapi] Bump github.com/moby/spdystream to v0.5.1 (#13252 @kevinpollet)
  • [file] Improve file provider behavior regarding dangling symlinks (#12449 @fh-yuxiao-zeng)
  • [server] Bump github.com/bytedance/sonic to v1.15.1 (#13254 @kevinpollet)
  • [middleware, authentication] Add error on basic auth build if users is empty (#13195 @rtribotte)
  • [k8s/ingress] Avoid ingress path matcher injection and backport 11d251415 (#13227 @rtribotte)
  • [server] Move snicheck to ctx instead of simulated routing (#13214 @juliens)
  • [middleware] Reject requests with different paths after StripPrefix and StripPrefixRegex normalisation (#13215 @rtribotte)
  • [server] Bump golang.org/x/net to v0.55.0 (#13251 @kevinpollet)
  • [k8s/gatewayapi] Change default values and expose configuration for Kubernetes client QPS and Burst (#13277 @kevinpollet)
  • [server] Bump golang.org/x/crypto to v0.52.0 (#13276 @rtribotte)

Documentation:

  • [file] Replace generated File routing reference page (#13170 @sheddy-traefik)
  • [k8s/crd] Fix typo in accesslogs field name (#13177 @PlayMTL)
  • [k8s/ingress-nginx] Surface the Ingress status race condition during NGINX coexistence (#13205 @emilevauge)
  • Polish grammar in migration guides (#13174 @quyentonndbs)
  • [middleware] Remove whitespace in HTML tag (#13160 @marbon87)
  • Add @LBF38 as a current maintainer (#13225 @emilevauge)
  • [k8s/ingress-nginx] Capitalize NGINX in kubernetesIngressNGINX (#13236 @smellems)

下载链接