7.5
Élevée
CVE-2026-25949 Traefik is an HTTP reverse proxy and load balancer
Description
Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.8, there is a potential vulnerability in Traefik managing STARTTLS requests. An unauthenticated client can bypass Traefik entrypoint respondingTimeouts.readTimeout by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing connections to remain open indefinitely, leading to a denial of service. This vulnerability is fixed in 3.6.8.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| traefik 3.6 | premières → < 3.6.8 | 3.6.8 |
| Red Hat OpenShift Dev Spaces 3.27 1774227265 | premières → < 1774227265 | 1774227265 |
Références
- github.com github.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de traefik
Les 80 CVE de traefik →
CVE-2026-121966
Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak
7.0
Élevée
CVE-2026-119574
Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated…
8.2
Élevée
CVE-2026-119573
Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the…
2.1
Faible
CVE-2026-119572
Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider
7.0
Élevée