Vulnerability · Published Jan 15, 2026 · Assigned by GitHub_M
CVE-2026-22045Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall
Medium 5.9
In plain English
A medium-severity resource allocation without limits in traefik from traefik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.35 and 3.6.7, there is a potential vulnerability in Traefik ACME TLS certificates' automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up go routines and file descriptors indefinitely when the ACME TLS challenge is enabled. A malicious client can open many connections, send a minimal ClientHello with acme-tls/1, then stop responding, leading to denial of service of the entry point. The vulnerability is fixed in 2.11.35 and 3.6.7.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/traefik/traefik | no fix listed | GO-2026-4322 |
| Go | github.com/traefik/traefik/v2 | 2.11.35 | GHSA-cwjm-3f7h-9hwq |
| Go | github.com/traefik/traefik/v2 | 2.11.35 | GO-2026-4322 |
| Go | github.com/traefik/traefik/v3 | 3.6.7 | GHSA-cwjm-3f7h-9hwq |
| Go | github.com/traefik/traefik/v3 | 3.6.7 | GO-2026-4322 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/traefik/traefik/security/advisories/GHSA-cwjm-3f7h-9hwq x_refsource_CONFIRM
- https://github.com/traefik/traefik/commit/e9f3089e9045812bcf1b410a9d40568917b26c3d x_refsource_MISC
- https://github.com/traefik/traefik/releases/tag/v2.11.35 x_refsource_MISC
- https://github.com/traefik/traefik/releases/tag/v3.6.7 x_refsource_MISC