PT-2026-7873 · Traefik · Traefik

Manizada · Published 2026-02-12 · Updated 2026-03-03 · CVE-2026-25949

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 3.6.8

Description Traefik, an HTTP reverse proxy and load balancer, contains a flaw in how it manages STARTTLS requests. An unauthenticated client can bypass the respondingTimeouts.readTimeout setting by sending an 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling the connection. This causes connections to remain open indefinitely, leading to a denial of service. The issue occurs during protocol detection before routing, and is reachable on an entrypoint even without any Postgres/TCP routers configured. An attacker can send the Postgres SSLRequest, receive a response from Traefik, and then stop sending further bytes, keeping the connection open past the configured read timeout. This consumes file descriptors and goroutines, potentially exhausting system resources and causing the proxy to become unavailable.

Recommendations Upgrade to Traefik version 3.6.8 or later to resolve this issue.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-25949

GHSA-89P3-4642-CR2W

GO-2026-4484

OPENSUSE-SU-2026:10217-1

SUSE-SU-2026:0757-1

Affected Products

Traefik

References · 121

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25949.json · Exploit
• https://github.com/traefik/traefik/security/advisories/GHSA-89p3-4642-cr2w · Vendor Advisory
• https://github.com/traefik/traefik/commit/31e566e9f1d7888ccb6fbc18bfed427203c35678 · Patch
• https://osv.dev/vulnerability/GHSA-89p3-4642-cr2w · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4484 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25949 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25949 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10217-1 · Vendor Advisory
• https://github.com/traefik/traefik · Note
• https://github.com/traefik/traefik/releases/tag/v3.6.8 · Note
• https://suse.com/security/cve/CVE-2017-18907 · Note
• https://twitter.com/VolerionSec/status/2022042719820914939 · Twitter Post
• https://suse.com/security/cve/CVE-2017-18916 · Note
• https://suse.com/security/cve/CVE-2026-25793 · Note