GHSA-rr42-h8r2-f28g

There is a potential vulnerability in Traefik's BasicAuth middleware. The middleware does not limit the length of the password before it hashes it, and the MD5-crypt hash formats ($apr1$, $1$) take more CPU time as the password gets longer. An unauthenticated attacker can send requests with passwords up to the entry point maxHeaderBytes limit (1 MiB by default) and use a large amount of CPU on each request, which degrades the availability of Traefik. The patched versions reject passwords longer than 1024 bytes.