Junglewise Threat Intelligence

CVE-2026-26999: Traefik resource exhaustion via stalled TLS handshakes in TCP routers

CVE-2026-26999 · Severity: high · CVSS 7.5 · Published 2026-03-05

Technologies: github.com/traefik/traefik/v3 (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik (Go). Vendors: Red Hat, Traefik Labs, Go.

Executive brief

Traefik, a widely used tool for routing and balancing internet traffic, contains a flaw in how it handles secure (TLS) connections on certain routers. An unauthenticated attacker can send incomplete data to the system, causing it to wait indefinitely and keep connections open. By doing this repeatedly, an attacker can exhaust the system's resources, potentially leading to a complete service outage for all applications relying on that entry point.

Technical details

A resource exhaustion vulnerability exists in Traefik's TCP router due to improper deadline management during TLS protocol sniffing. The `(*Router).ServeTCP` function clears the connection-level read deadline before the TLS handshake is fully completed. An unauthenticated remote attacker can exploit this by initiating a TLS connection and sending a partial record header, then ceasing transmission. Because the deadline is removed, the subsequent handshake read blocks indefinitely, consuming file descriptors and goroutines. This can be scaled to exhaust system resources and degrade the availability of the affected entrypoint. The issue is patched in versions 2.11.38 and 3.6.9 by ensuring deadlines are preserved or enforced during the handshake.

Affected products

  • Traefik Labs Traefik < 2.11.38, 3.0.0 to < 3.6.9
  • Red Hat Red Hat OpenShift Dev Spaces 3.27 3.27.1

Timeline

  • 2026-02-23: patched: Versions 2.11.38 and 3.6.9 released.
  • 2026-03-04: advisory: GitHub Security Advisory published.
  • 2026-03-05: disclosed: CVE published to NVD.
  • 2026-04-23: advisory: Red Hat published security advisory RHSA-2026:10175.

References

Related threats