Description
Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.8, there is a potential vulnerability in Traefik managing STARTTLS requests. An unauthenticated client can bypass Traefik entrypoint respondingTimeouts.readTimeout by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing connections to remain open indefinitely, leading to a denial of service. This vulnerability is fixed in 3.6.8.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
traefik traefik
< 3.6.8affected
References
- https://github.com/traefik/traefik/security/advisories/GHSA-89p3-4642-cr2w ↗
- https://github.com/traefik/traefik/commit/31e566e9f1d7888ccb6fbc18bfed427203c35678 ↗
- https://github.com/traefik/traefik/releases/tag/v3.6.8 ↗
- https://access.redhat.com/security/cve/CVE-2026-25949 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2439522 ↗
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25949.json ↗
- https://access.redhat.com/errata/RHSA-2026:6192 ↗