High severityNVD Advisory· Published Feb 12, 2026· Updated Feb 12, 2026
Traefik: TCP readTimeout bypass via STARTTLS on Postgres
CVE-2026-25949
Description
Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.8, there is a potential vulnerability in Traefik managing STARTTLS requests. An unauthenticated client can bypass Traefik entrypoint respondingTimeouts.readTimeout by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing connections to remain open indefinitely, leading to a denial of service. This vulnerability is fixed in 3.6.8.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/traefik/traefik/v3Go | < 3.6.8 | 3.6.8 |
Affected products
7- osv-coords6 versionspkg:apk/chainguard/traefik-2.11pkg:apk/chainguard/traefik-3.5pkg:apk/wolfi/traefik-3.5pkg:golang/github.com/traefik/traefik/v3pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/traefik&distro=openSUSE%20Tumbleweed
< 2.11.38-r0+ 5 more
- (no CPE)range: < 2.11.38-r0
- (no CPE)range: < 3.5.6-r6
- (no CPE)range: < 3.5.6-r6
- (no CPE)range: < 3.6.8
- (no CPE)range: < 0.0.20260226T182644-150000.1.149.1
- (no CPE)range: < 3.6.8-1.1
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-89p3-4642-cr2wghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-25949ghsaADVISORY
- github.com/traefik/traefik/commit/31e566e9f1d7888ccb6fbc18bfed427203c35678ghsax_refsource_MISCWEB
- github.com/traefik/traefik/releases/tag/v3.6.8ghsax_refsource_MISCWEB
- github.com/traefik/traefik/security/advisories/GHSA-89p3-4642-cr2wghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.