CVE-2026-25949
High · 7.5CVSS
7.5
EPSS
0.9%
Published
Feb 12, 2026
CISA due date
—
The record
Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.8, there is a potential vulnerability in Traefik managing STARTTLS requests. An unauthenticated client can bypass Traefik entrypoint respondingTimeouts.readTimeout by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing connections to remain open indefinitely, leading to a denial of service. This vulnerability is fixed in 3.6.8.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/traefik/traefik | 0 | No fix |
| Go | github.com/traefik/traefik/v2 | 0 | No fix |
| Go | github.com/traefik/traefik/v3 | 0 | 3.6.8 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260226T182644-150000.1.149.1 |
| openSUSE:Tumbleweed | traefik | 0 | 3.6.8-1.1 |
Related vulnerabilities
- GO-2026-4484 Traefik: TCP readTimeout bypass via STARTTLS on Postgres in github.com/traefik/traefik Same vulnerability
- GO-2026-4530 Traefik affected by TLS ClientAuth Bypass on HTTP/3 in github.com/traefik/traefik Also affects github.com/traefik/traefik
- GO-2026-4322 Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall in… Also affects github.com/traefik/traefik
- CVE-2026-22045 Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall Also affects github.com/traefik/traefik
- GO-2025-4205 Traefik Inverted TLS Verification Logic in ingress-nginx Provider in… Also affects github.com/traefik/traefik
- GO-2025-4206 Path Normalization Bypass in Traefik Router + Middleware Rules in… Also affects github.com/traefik/traefik
- CVE-2025-66490 Traefik is an HTTP reverse proxy and load balancer. Also affects github.com/traefik/traefik
- CVE-2025-66491 Traefik has Inverted TLS Verification Logic in its ingress-nginx Provider Also affects github.com/traefik/traefik