CVE-2026-22045

Katalog CVE

CVSS 7.5 · High EPSS 0,34%

Kerentanan Allocation of Resources Without Limits or Throttling pada traefik. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.35 and 3.6.7, there is a potential vulnerability in Traefik ACME TLS certificates' automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up go routines and file descriptors indefinitely when the ACME TLS challenge is enabled. A malicious client can open many connections, send a minimal ClientHello with acme-tls/1, then stop responding, leading to denial of service of the entry point. The vulnerability is fixed in 2.11.35 and 3.6.7.

Rincian

Terbit di NVD

15 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/traefik/traefik/security/advisories/GHSA-cwjm-3f7h-9hwq patch · advisory vendor
• https://github.com/traefik/traefik/commit/e9f3089e9045812bcf1b410a9d40568917b26c3d patch
• https://github.com/traefik/traefik/releases/tag/v2.11.35 release notes
• https://github.com/traefik/traefik/releases/tag/v3.6.7 release notes