Skip to content
fr Sign in
7.5 High

CVE-2026-25949 Traefik is an HTTP reverse proxy and load balancer

Description

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.8, there is a potential vulnerability in Traefik managing STARTTLS requests. An unauthenticated client can bypass Traefik entrypoint respondingTimeouts.readTimeout by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing connections to remain open indefinitely, leading to a denial of service. This vulnerability is fixed in 3.6.8.

Affected products and versions

Product Affected versions Fixed in
traefik 3.6 earliest → < 3.6.8 3.6.8
Red Hat OpenShift Dev Spaces 3.27 1774227265 earliest → < 1774227265 1774227265

References

Timeline

  1. Published
  2. Last modified

Other CVEs of traefik

The 80 CVEs of traefik →
CVE-2026-121966 Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak 7.0 High CVE-2026-119574 Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated… 8.2 High CVE-2026-119573 Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the… 2.1 Low CVE-2026-119572 Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider 7.0 High
Track this CVE