CVE-2026-25949

Katalog CVE

CVSS 7.5 · High EPSS 0,91%

Kerentanan Uncontrolled Resource Consumption pada traefik. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.8, there is a potential vulnerability in Traefik managing STARTTLS requests. An unauthenticated client can bypass Traefik entrypoint respondingTimeouts.readTimeout by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing connections to remain open indefinitely, leading to a denial of service. This vulnerability is fixed in 3.6.8.

Rincian

Terbit di NVD

12 Februari 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,91% peluang dieksploitasi; lebih tinggi dari 59,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/traefik/traefik/security/advisories/GHSA-89p3-4642-cr2w patch · advisory vendor
• https://github.com/traefik/traefik/commit/31e566e9f1d7888ccb6fbc18bfed427203c35678 patch
• https://github.com/traefik/traefik/releases/tag/v3.6.8 product · release notes
• https://access.redhat.com/errata/RHSA-2026:6192
• https://access.redhat.com/security/cve/CVE-2026-25949
• https://bugzilla.redhat.com/show_bug.cgi?id=2439522
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25949.json