High severity7.5NVD Advisory· Published Feb 12, 2026· Updated Jul 15, 2026
CVE-2026-25949
CVE-2026-25949
Description
Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.8, there is a potential vulnerability in Traefik managing STARTTLS requests. An unauthenticated client can bypass Traefik entrypoint respondingTimeouts.readTimeout by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing connections to remain open indefinitely, leading to a denial of service. This vulnerability is fixed in 3.6.8.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/traefik/traefik/v3Go | < 3.6.8 | 3.6.8 |
Affected products
10- osv-coords8 versionspkg:apk/chainguard/traefik-2.11pkg:apk/chainguard/traefik-3.5pkg:apk/chainguard/traefik-fips-2.11pkg:apk/wolfi/traefik-3.5pkg:golang/github.com/traefik/traefik/v3pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/traefik&distro=openSUSE%20Tumbleweed
< 2.11.38-r0+ 7 more
- (no CPE)range: < 2.11.38-r0
- (no CPE)range: < 3.5.6-r6
- (no CPE)range: < 2.11.51-r0
- (no CPE)range: < 3.5.6-r6
- (no CPE)range: < 3.6.8
- (no CPE)range: < 0.0.20260226T182644-150000.1.149.1
- (no CPE)range: < 0.0.20260723T184607-160000.1.1
- (no CPE)range: < 3.6.8-1.1
Patches
Vulnerability mechanics
References
9- github.com/traefik/traefik/commit/31e566e9f1d7888ccb6fbc18bfed427203c35678nvdPatchWEB
- github.com/traefik/traefik/security/advisories/GHSA-89p3-4642-cr2wnvdPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-89p3-4642-cr2wghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-25949ghsaADVISORY
- access.redhat.com/errata/RHSA-2026:6192nvdWEB
- access.redhat.com/security/cve/CVE-2026-25949nvdWEB
- bugzilla.redhat.com/show_bug.cginvdWEB
- github.com/traefik/traefik/releases/tag/v3.6.8nvdProductRelease NotesWEB
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25949.jsonnvdWEB
News mentions
0No linked articles in our index yet.