Vulnerability · Published Mar 5, 2026 · Assigned by GitHub_M

CVE-2026-26999Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS)

High 7.5

In plain English

A high-severity uncontrolled resource consumption in traefik from traefik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 50.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing TLS handshake on TCP routers. When Traefik processes a TLS connection on a TCP router, the read deadline used to bound protocol sniffing is cleared before the TLS handshake is completed. When a TLS handshake read error occurs, the code attempts a second handshake with different connection parameters, silently ignoring the initial error. A remote unauthenticated client can exploit this by sending an incomplete TLS record and stopping further data transmission, causing the TLS handshake to stall indefinitely and holding connections open. By opening many such stalled connections in parallel, an attacker can exhaust file descriptors and goroutines, degrading availability of all services on the affected entrypoint. This issue has been patched in versions 2.11.38 and 3.6.9.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/traefik/traefik	no fix listed	GO-2026-4594
Go	github.com/traefik/traefik/v2	2.11.38	GHSA-xw98-5q62-jx94
Go	github.com/traefik/traefik/v2	2.11.38	GO-2026-4594
Go	github.com/traefik/traefik/v3	3.6.9	GHSA-xw98-5q62-jx94
Go	github.com/traefik/traefik/v3	3.6.9	GO-2026-4594

Affected products (as reported)

Vendor	Product	Versions
traefik	traefik	< 2.11.38< 3.6.9

Weakness: CWE-400, CWE-772 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/traefik/traefik/security/advisories/GHSA-xw98-5q62-jx94 x_refsource_CONFIRM
https://github.com/traefik/traefik/releases/tag/v2.11.38 x_refsource_MISC
https://github.com/traefik/traefik/releases/tag/v3.6.9 x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2026-26999 vdb-entry, x_refsource_REDHAT
RHBZ#2444874 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26999.json x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:10175 vendor-advisory, x_refsource_REDHAT