CVE’s fixed:

• CVE-2025-32431 (Advisory GHSA-6p68-w45g-48j7)
• CVE-2025-22868 (Advisory GHSA-3wqc-mwfx-672p)
• CVE-2025-22871 (Advisory GHSA-5423-jcjm-2gpv)

Important:

Since v3.3.6, the incoming request path is now cleaned before being used to match the router rules and sent to the backends. Any /../, /./ or duplicate slash segments in the request path is interpreted and/or collapsed.

Please read the migration guide.

Documentation:

• [k8s/gatewayapi] Fix Kubernetes Gateway statusAddress documentation (#11663 by kevinpollet)
• [tracing] Document how to pass multiple Headers on tracing with CLI (#11665 by mloiseleur)
• Fix typos on what is Traefik docs page (#11685 by matthewCmatt)
• Update Welcome Page (#11615 by sheddy-traefik)

Misc:

• Merge branch v2.11 into v3.3 (#11703 by kevinpollet)
• Merge branch v2.11 into v3.3 (#11696 by rtribotte)
• Merge branch v2.11 into v3.3 (#11694 by rtribotte)