GO-2026-4322
NoneCVSS
—
EPSS
—
Published
Jan 23, 2026
CISA due date
—
The record
Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall in github.com/traefik/traefik
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/traefik/traefik | 0 | No fix |
| Go | github.com/traefik/traefik/v2 | 0 | 2.11.35 |
| Go | github.com/traefik/traefik/v3 | 0 | 3.6.7 |
Related vulnerabilities
- CVE-2026-22045 Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall Same vulnerability
- GO-2026-4530 Traefik affected by TLS ClientAuth Bypass on HTTP/3 in github.com/traefik/traefik Also affects github.com/traefik/traefik
- GO-2026-4484 Traefik: TCP readTimeout bypass via STARTTLS on Postgres in github.com/traefik/traefik Also affects github.com/traefik/traefik
- CVE-2026-25949 Traefik is an HTTP reverse proxy and load balancer. Also affects github.com/traefik/traefik
- GO-2025-4205 Traefik Inverted TLS Verification Logic in ingress-nginx Provider in… Also affects github.com/traefik/traefik
- GO-2025-4206 Path Normalization Bypass in Traefik Router + Middleware Rules in… Also affects github.com/traefik/traefik
- CVE-2025-66490 Traefik is an HTTP reverse proxy and load balancer. Also affects github.com/traefik/traefik
- CVE-2025-66491 Traefik has Inverted TLS Verification Logic in its ingress-nginx Provider Also affects github.com/traefik/traefik