Cloudanix VulnDB

CVE-2026-22045

Medium · 5.9

Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall

CVSS

5.9

EPSS

0.3%

Published

Jan 15, 2026

CISA due date

—

The record

- Affected code: `pkg/server/router/tcp/router.go` (ACME TLS-ALPN handling). - When a ClientHello advertises `acme-tls/1`, Traefik intercepts it and calls `tls.Server(...).Handshake()` without any read/write deadlines and without closing the connection afterward. - Immediately before this branch, existing deadlines set by the entrypoint are cleared. - A client that sends the ALPN marker and then stops responding can keep the goroutine and socket open indefinitely, potentially exhausting the entrypoint under load. - Exposure is limited to entrypoints where the ACME TLS-ALPN challenge is enabled and ACME bypass is not allowed.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/traefik/traefik 0 No fix
Go github.com/traefik/traefik/v2 0 2.11.35
Go github.com/traefik/traefik/v3 0 3.6.7
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20260123T022811-150000.1.140.1
openSUSE:Tumbleweed traefik 0 3.6.7-1.1
openSUSE:Tumbleweed traefik2 0 2.11.35-1.1

Related vulnerabilities