CVE-2026-25949
CVE-2026-25949 · Traefik: TCP readTimeout bypass via STARTTLS on Postgres
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.8, there is a potential vulnerability in Traefik managing STARTTLS requests. An unauthenticated client can bypass Traefik entrypoint respondingTimeouts.readTimeout by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing connections to remain open indefinitely, leading to a denial of service. This vulnerability is fixed in 3.6.8.
CVSS 7.5 · Alta · EPSS 0,8%
- Publicación
- Actualización
Pila tecnológica: web
Productos y versiones afectados
traefik
- Versiones
- < 3.6.8: Afectada
Sin corrección publicada
Fuentes originales
- https://github.com/traefik/traefik/security/advisories/GHSA-89p3-4642-cr2w
- https://github.com/traefik/traefik/commit/31e566e9f1d7888ccb6fbc18bfed427203c35678
- https://github.com/traefik/traefik/releases/tag/v3.6.8
- https://access.redhat.com/security/cve/CVE-2026-25949
- https://bugzilla.redhat.com/show_bug.cgi?id=2439522
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25949.json
- https://access.redhat.com/errata/RHSA-2026:6192
- https://nvd.nist.gov/vuln/detail/CVE-2026-25949