CVE-2026-25949
CVE-2026-25949 · Traefik: TCP readTimeout bypass via STARTTLS on Postgres
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.8, there is a potential vulnerability in Traefik managing STARTTLS requests. An unauthenticated client can bypass Traefik entrypoint respondingTimeouts.readTimeout by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing connections to remain open indefinitely, leading to a denial of service. This vulnerability is fixed in 3.6.8.
CVSS 7.5 · High · EPSS 0.9%
- Published
- Updated
Stack: web
Affected products and versions
traefik
- Versions
- < 3.6.8: Affected
No fix published
Original sources
- https://github.com/traefik/traefik/security/advisories/GHSA-89p3-4642-cr2w
- https://github.com/traefik/traefik/commit/31e566e9f1d7888ccb6fbc18bfed427203c35678
- https://github.com/traefik/traefik/releases/tag/v3.6.8
- https://access.redhat.com/security/cve/CVE-2026-25949
- https://bugzilla.redhat.com/show_bug.cgi?id=2439522
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25949.json
- https://access.redhat.com/errata/RHSA-2026:6192
- https://nvd.nist.gov/vuln/detail/CVE-2026-25949