Vulnerability-Lookup

CVE-2026-22045 (GCVE-0-2026-22045)

Vulnerability from cvelistv5 – Published: 2026-01-15 22:44 – Updated: 2026-01-20 16:29

Title

Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall

Summary

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.35 and 3.6.7, there is a potential vulnerability in Traefik ACME TLS certificates' automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up go routines and file descriptors indefinitely when the ACME TLS challenge is enabled. A malicious client can open many connections, send a minimal ClientHello with acme-tls/1, then stop responding, leading to denial of service of the entry point. The vulnerability is fixed in 2.11.35 and 3.6.7.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-20 16:29 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/traefik/traefik/security/advis…	x_refsource_CONFIRM
https://github.com/traefik/traefik/commit/e9f3089…	x_refsource_MISC
https://github.com/traefik/traefik/releases/tag/v…	x_refsource_MISC
https://github.com/traefik/traefik/releases/tag/v3.6.7	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
traefik	traefik	Affected: < 2.11.35 Affected: >=3.0.0-beta1, < 3.6.7	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22045",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-20T16:29:14.971395Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-20T16:29:37.648Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "traefik",
          "vendor": "traefik",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.11.35"
            },
            {
              "status": "affected",
              "version": "\u003e=3.0.0-beta1, \u003c 3.6.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.35 and 3.6.7, there is a potential vulnerability in Traefik ACME TLS certificates\u0027 automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up go routines and file descriptors indefinitely when the ACME TLS challenge is enabled. A malicious client can open many connections, send a minimal ClientHello with acme-tls/1, then stop responding, leading to denial of service of the entry point. The vulnerability is fixed in 2.11.35 and 3.6.7."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T22:44:05.423Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/traefik/traefik/security/advisories/GHSA-cwjm-3f7h-9hwq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/traefik/traefik/security/advisories/GHSA-cwjm-3f7h-9hwq"
        },
        {
          "name": "https://github.com/traefik/traefik/commit/e9f3089e9045812bcf1b410a9d40568917b26c3d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/traefik/traefik/commit/e9f3089e9045812bcf1b410a9d40568917b26c3d"
        },
        {
          "name": "https://github.com/traefik/traefik/releases/tag/v2.11.35",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/traefik/traefik/releases/tag/v2.11.35"
        },
        {
          "name": "https://github.com/traefik/traefik/releases/tag/v3.6.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/traefik/traefik/releases/tag/v3.6.7"
        }
      ],
      "source": {
        "advisory": "GHSA-cwjm-3f7h-9hwq",
        "discovery": "UNKNOWN"
      },
      "title": "Traefik\u0027s ACME TLS-ALPN fast path lacks timeouts and close on handshake stall"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-22045",
    "datePublished": "2026-01-15T22:44:05.423Z",
    "dateReserved": "2026-01-05T22:30:38.720Z",
    "dateUpdated": "2026-01-20T16:29:37.648Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-22045",
      "date": "2026-09-23",
      "epss": "0.00348",
      "percentile": "0.28445"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "traefik",
                "vendor": "traefik",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.11.35"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e=3.0.0-beta1, \u003c 3.6.7"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "84C034EA-1F19-462D-9472-68F1CAA93115",
                    "versionEndExcluding": "2.11.35",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "44AA42E3-588B-4741-B128-74C761D1B5FA",
                    "versionEndExcluding": "3.6.7",
                    "versionStartIncluding": "3.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.35 and 3.6.7, there is a potential vulnerability in Traefik ACME TLS certificates\u0027 automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up go routines and file descriptors indefinitely when the ACME TLS challenge is enabled. A malicious client can open many connections, send a minimal ClientHello with acme-tls/1, then stop responding, leading to denial of service of the entry point. The vulnerability is fixed in 2.11.35 and 3.6.7."
          },
          {
            "lang": "es",
            "value": "Traefik es un proxy inverso HTTP y balanceador de carga. Antes de 2.11.35 y 3.6.7, existe una potencial vulnerabilidad en la generaci\u00f3n autom\u00e1tica de certificados TLS ACME de Traefik: la ruta r\u00e1pida ACME TLS-ALPN puede permitir a clientes no autenticados acaparar go routines y descriptores de archivo indefinidamente cuando el desaf\u00edo ACME TLS est\u00e1 habilitado. Un cliente malicioso puede abrir muchas conexiones, enviar un ClientHello m\u00ednimo con acme-tls/1, luego dejar de responder, lo que lleva a una denegaci\u00f3n de servicio del punto de entrada. La vulnerabilidad est\u00e1 corregida en 2.11.35 y 3.6.7."
          }
        ],
        "id": "CVE-2026-22045",
        "lastModified": "2026-06-17T10:19:25.200",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-22045",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-20T16:29:14.971395Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-01-15T23:15:51.593",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/traefik/traefik/commit/e9f3089e9045812bcf1b410a9d40568917b26c3d"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/traefik/traefik/releases/tag/v2.11.35"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/traefik/traefik/releases/tag/v3.6.7"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://github.com/traefik/traefik/security/advisories/GHSA-cwjm-3f7h-9hwq"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-770"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-21T17:13:56+00:00",
      "cve": "CVE-2026-22045",
      "id": "CVE-2026-22045",
      "initial_release_date": "2026-01-15T22:44:05.423000+00:00",
      "product_status:fixed": "4",
      "product_status:known_not_affected": "57",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "traefik: Traefik: Denial of Service via ACME TLS-ALPN fast path resource exhaustion",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22045.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-06-25T02:30:02Z",
      "cve": "CVE-2026-22045",
      "id": "CVE-2026-22045",
      "initial_release_date": "2026-01-17T00:25:01Z",
      "product_status:recommended": "2",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-22045",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-22045.json",
      "version": "5"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-22045",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-01-20T16:29:14.971395Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-01-20T16:29:31.728Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "traefik",
              "vendor": "traefik",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.11.35"
                },
                {
                  "status": "affected",
                  "version": "\u003e=3.0.0-beta1, \u003c 3.6.7"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.35 and 3.6.7, there is a potential vulnerability in Traefik ACME TLS certificates\u0027 automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up go routines and file descriptors indefinitely when the ACME TLS challenge is enabled. A malicious client can open many connections, send a minimal ClientHello with acme-tls/1, then stop responding, leading to denial of service of the entry point. The vulnerability is fixed in 2.11.35 and 3.6.7."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-770",
                  "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-01-15T22:44:05.423Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/traefik/traefik/security/advisories/GHSA-cwjm-3f7h-9hwq",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/traefik/traefik/security/advisories/GHSA-cwjm-3f7h-9hwq"
            },
            {
              "name": "https://github.com/traefik/traefik/commit/e9f3089e9045812bcf1b410a9d40568917b26c3d",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/traefik/traefik/commit/e9f3089e9045812bcf1b410a9d40568917b26c3d"
            },
            {
              "name": "https://github.com/traefik/traefik/releases/tag/v2.11.35",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/traefik/traefik/releases/tag/v2.11.35"
            },
            {
              "name": "https://github.com/traefik/traefik/releases/tag/v3.6.7",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/traefik/traefik/releases/tag/v3.6.7"
            }
          ],
          "source": {
            "advisory": "GHSA-cwjm-3f7h-9hwq",
            "discovery": "UNKNOWN"
          },
          "title": "Traefik\u0027s ACME TLS-ALPN fast path lacks timeouts and close on handshake stall"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-22045",
        "datePublished": "2026-01-15T22:44:05.423Z",
        "dateReserved": "2026-01-05T22:30:38.720Z",
        "dateUpdated": "2026-01-20T16:29:37.648Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CLEANSTART-2026-DQ38367 (CVE-2026-22045)

Vulnerability from cleanstart – Published: 2026-09-18 09:51 – Updated: 2026-08-03 09:45 – Source website

Summary

Security fix for CVE-2026-22045 applied in: forecastle 1.0.159-r1

Details

Security vulnerability affects the forecastle package. This issue is resolved in later releases. See references for vulnerability details.

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2026-22045	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-22045	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "forecastle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.159-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Security vulnerability affects the forecastle package. This issue is resolved in later releases. See references for vulnerability details.",
  "id": "CLEANSTART-2026-DQ38367",
  "modified": "2026-08-03T09:45:51Z",
  "published": "2026-09-18T09:51:38.435645Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-DQ38367.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-22045"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22045"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fix for CVE-2026-22045 applied in: forecastle 1.0.159-r1",
  "upstream": [
    "CVE-2026-22045"
  ]
}

CLEANSTART-2026-QI45196 (CVE-2026-40611)

Vulnerability from cleanstart – Published: 2026-08-13 12:10 – Updated: 2026-09-18 11:59 – Source website

Withdrawn 2026-09-18

Summary

Security fixes in forecastle 1.0.159-r1

Details

Package forecastle version 1.0.159-r1 fixes 43 vulnerabilities: CVE-2026-40611, CVE-2026-34986, CVE-2026-48020, CVE-2026-26999, CVE-2026-29054...

References

URL

Type

https://github.com/stakater/Forecastle

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "forecastle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.159-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.159-r1"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package forecastle version 1.0.159-r1 fixes 43 vulnerabilities: CVE-2026-40611, CVE-2026-34986, CVE-2026-48020, CVE-2026-26999, CVE-2026-29054...",
  "id": "CLEANSTART-2026-QI45196",
  "modified": "2026-09-18T11:59:01.768079Z",
  "published": "2026-08-13T12:10:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/stakater/Forecastle"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in forecastle 1.0.159-r1",
  "upstream": [
    "CVE-2026-40611",
    "CVE-2026-34986",
    "CVE-2026-48020",
    "CVE-2026-26999",
    "CVE-2026-29054",
    "CVE-2026-32305",
    "CVE-2026-35051",
    "CVE-2026-39858",
    "CVE-2026-40912",
    "ghsa-46wh-3698-f2cx",
    "ghsa-4hjq-9h5c-252j",
    "ghsa-gv8r-9rw9-9697",
    "CVE-2026-22045",
    "CVE-2026-26998",
    "CVE-2026-32595",
    "CVE-2026-33433",
    "CVE-2026-41174",
    "CVE-2026-41181",
    "CVE-2026-41263",
    "CVE-2026-44774",
    "CVE-2026-39828",
    "CVE-2026-39829",
    "CVE-2026-39830",
    "CVE-2026-39831",
    "CVE-2026-39832",
    "CVE-2026-39835",
    "CVE-2026-42508",
    "CVE-2026-46595",
    "CVE-2026-46597",
    "CVE-2026-39827",
    "CVE-2026-39833",
    "CVE-2026-39834",
    "CVE-2026-46598",
    "CVE-2026-25681",
    "CVE-2026-27136",
    "CVE-2026-33814",
    "CVE-2026-39821",
    "CVE-2026-25680",
    "CVE-2026-42502",
    "CVE-2026-42506",
    "CVE-2026-46600",
    "CVE-2026-39824",
    "CVE-2026-56852"
  ],
  "withdrawn": "2026-09-18T11:59:01.768079Z"
}

FKIE_CVE-2026-22045

Vulnerability from fkie_nvd - Published: 2026-01-15 23:15 - Updated: 2026-06-17 10:19

Severity

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/traefik/traefik/commit/e9f3089e9045812bcf1b410a9d40568917b26c3d	Patch
security-advisories@github.com	https://github.com/traefik/traefik/releases/tag/v2.11.35	Release Notes
security-advisories@github.com	https://github.com/traefik/traefik/releases/tag/v3.6.7	Release Notes
security-advisories@github.com	https://github.com/traefik/traefik/security/advisories/GHSA-cwjm-3f7h-9hwq	Patch, Vendor Advisory

Impacted products

	Vendor	Product	Version
	traefik	traefik	*
	traefik	traefik	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "traefik",
          "vendor": "traefik",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.11.35"
            },
            {
              "status": "affected",
              "version": "\u003e=3.0.0-beta1, \u003c 3.6.7"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "84C034EA-1F19-462D-9472-68F1CAA93115",
              "versionEndExcluding": "2.11.35",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "44AA42E3-588B-4741-B128-74C761D1B5FA",
              "versionEndExcluding": "3.6.7",
              "versionStartIncluding": "3.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.35 and 3.6.7, there is a potential vulnerability in Traefik ACME TLS certificates\u0027 automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up go routines and file descriptors indefinitely when the ACME TLS challenge is enabled. A malicious client can open many connections, send a minimal ClientHello with acme-tls/1, then stop responding, leading to denial of service of the entry point. The vulnerability is fixed in 2.11.35 and 3.6.7."
    },
    {
      "lang": "es",
      "value": "Traefik es un proxy inverso HTTP y balanceador de carga. Antes de 2.11.35 y 3.6.7, existe una potencial vulnerabilidad en la generaci\u00f3n autom\u00e1tica de certificados TLS ACME de Traefik: la ruta r\u00e1pida ACME TLS-ALPN puede permitir a clientes no autenticados acaparar go routines y descriptores de archivo indefinidamente cuando el desaf\u00edo ACME TLS est\u00e1 habilitado. Un cliente malicioso puede abrir muchas conexiones, enviar un ClientHello m\u00ednimo con acme-tls/1, luego dejar de responder, lo que lleva a una denegaci\u00f3n de servicio del punto de entrada. La vulnerabilidad est\u00e1 corregida en 2.11.35 y 3.6.7."
    }
  ],
  "id": "CVE-2026-22045",
  "lastModified": "2026-06-17T10:19:25.200",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-22045",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-01-20T16:29:14.971395Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-01-15T23:15:51.593",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/traefik/traefik/commit/e9f3089e9045812bcf1b410a9d40568917b26c3d"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/traefik/traefik/releases/tag/v2.11.35"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/traefik/traefik/releases/tag/v3.6.7"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-cwjm-3f7h-9hwq"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-CWJM-3F7H-9HWQ

Vulnerability from github – Published: 2026-01-15 22:58 – Updated: 2026-01-16 15:20

Summary

Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall

Details

Impact

There is a potential vulnerability in Traefik ACME TLS certificates' automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up goroutines and file descriptors indefinitely when the ACME TLS challenge is enabled.

A malicious client can open many connections, send a minimal ClientHello with acme-tls/1, then stop responding, leading to denial of service of the entrypoint.

Patches

https://github.com/traefik/traefik/releases/tag/v2.11.35
https://github.com/traefik/traefik/releases/tag/v3.6.7

For more information

If you have any questions or comments about this advisory, please open an issue.

Original Description # \[Security\] ACME TLS-ALPN fast path lacks timeouts and close on handshake stall Dear Traefik security team, We believe we have identified a resource-exhaustion issue in the ACME TLS-ALPN fast path that can allow unauthenticated clients to tie up goroutines and file descriptors indefinitely when the ACME TLS challenge is enabled. ## Summary - Affected code: `pkg/server/router/tcp/router.go` (ACME TLS-ALPN handling). - When a ClientHello advertises `acme-tls/1`, Traefik intercepts it and calls `tls.Server(...).Handshake()` without any read/write deadlines and without closing the connection afterward. - Immediately before this branch, existing deadlines set by the entrypoint are cleared. - A client that sends the ALPN marker and then stops responding can keep the goroutine and socket open indefinitely, potentially exhausting the entrypoint under load. - Exposure is limited to entrypoints where the ACME TLS-ALPN challenge is enabled and ACME bypass is not allowed. ## Relevant snippets ```143:171:pkg/server/router/tcp/router.go // Deadlines are cleared before protocol dispatch if err := conn.SetDeadline(time.Time{}); err != nil { log.Error().Err(err).Msg("Error while setting deadline") } // ACME TLS-ALPN fast path if !r.acmeTLSPassthrough && slices.Contains(hello.protos, tlsalpn01.ACMETLS1Protocol) { r.acmeTLSALPNHandler().ServeTCP(r.GetConn(conn, hello.peeked)) return }


```224:226:pkg/server/router/tcp/router.go
// Handler invoked by the branch above
return tcp.HandlerFunc(func(conn tcp.WriteCloser) {
    _ = tls.Server(conn, r.httpsTLSConfig).Handshake()
})

## Impact - Each stalled handshake consumes a goroutine and FD with no timeout and no server-side close. - A malicious client can open many connections, send a minimal ClientHello with `acme-tls/1`, then stop responding, leading to denial of service of the entrypoint. - Normal HTTPS handling uses `http.Server` timeouts; this bespoke path bypasses them. ## Conditions for exploitation - ACME TLS-ALPN challenge enabled (default when configured). - `allowACMEByPass` disabled for the entrypoint (the default when ACME TLS challenge is handled by Traefik). ## CWE - CWE-400: Uncontrolled Resource Consumption. ## Proposed fix (illustrative)

@@ func (r *Router) acmeTLSALPNHandler() tcp.Handler {
-    return tcp.HandlerFunc(func(conn tcp.WriteCloser) {
-        _ = tls.Server(conn, r.httpsTLSConfig).Handshake()
-    })
+    return tcp.HandlerFunc(func(conn tcp.WriteCloser) {
+        // Ensure the handshake cannot block indefinitely and always closes the socket.
+        _ = conn.SetReadDeadline(time.Now().Add(10 * time.Second))
+        _ = conn.SetWriteDeadline(time.Now().Add(10 * time.Second))
+
+        tlsConn := tls.Server(conn, r.httpsTLSConfig)
+        _ = tlsConn.Handshake()
+        _ = tlsConn.Close() // close regardless of handshake outcome
+    })
 }

Alternatively, route ACME TLS-ALPN through the existing `tcp.TLSHandler`/HTTP server path so the configured timeouts and lifecycle management apply automatically. ## CVSS v3.1 (estimate) - Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Base score: 7.5 (High) - Rationale: Network-only, no auth/user interaction required; impact is service availability via resource exhaustion; no confidentiality or integrity impact. Please let us know if you would like a PoC or further details. We have not made any code changes in this report. Let us know if you have any questions or need clarification\! Best wishes, Pavel Kohout Aisle Research

Severity

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.6.6"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.11.34"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.35"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-22045"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-15T22:58:23Z",
    "nvd_published_at": "2026-01-15T23:15:51Z",
    "severity": "MODERATE"
  },
  "details": "## Impact\n\nThere is a potential vulnerability in Traefik ACME TLS certificates\u0027 automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up goroutines and file descriptors indefinitely when the ACME TLS challenge is enabled.\n\nA malicious client can open many connections, send a minimal ClientHello with `acme-tls/1`, then stop responding, leading to denial of service of the entrypoint.  \n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.35\n- https://github.com/traefik/traefik/releases/tag/v3.6.7\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Description\u003c/summary\u003e\n\n# \\[Security\\] ACME TLS-ALPN fast path lacks timeouts and close on handshake stall\n\nDear Traefik security team,\n\nWe believe we have identified a resource-exhaustion issue in the ACME TLS-ALPN fast path that can allow unauthenticated clients to tie up goroutines and file descriptors indefinitely when the ACME TLS challenge is enabled.\n\n## Summary\n\n- Affected code: `pkg/server/router/tcp/router.go` (ACME TLS-ALPN handling).  \n- When a ClientHello advertises `acme-tls/1`, Traefik intercepts it and calls `tls.Server(...).Handshake()` without any read/write deadlines and without closing the connection afterward.  \n- Immediately before this branch, existing deadlines set by the entrypoint are cleared.  \n- A client that sends the ALPN marker and then stops responding can keep the goroutine and socket open indefinitely, potentially exhausting the entrypoint under load.  \n- Exposure is limited to entrypoints where the ACME TLS-ALPN challenge is enabled and ACME bypass is not allowed.\n\n## Relevant snippets\n```143:171:pkg/server/router/tcp/router.go\n// Deadlines are cleared before protocol dispatch\nif err := conn.SetDeadline(time.Time{}); err != nil {\n    log.Error().Err(err).Msg(\"Error while setting deadline\")\n}\n\n// ACME TLS-ALPN fast path\nif !r.acmeTLSPassthrough \u0026\u0026 slices.Contains(hello.protos, tlsalpn01.ACMETLS1Protocol) {\n    r.acmeTLSALPNHandler().ServeTCP(r.GetConn(conn, hello.peeked))\n    return\n}\n```\n\n```224:226:pkg/server/router/tcp/router.go\n// Handler invoked by the branch above\nreturn tcp.HandlerFunc(func(conn tcp.WriteCloser) {\n    _ = tls.Server(conn, r.httpsTLSConfig).Handshake()\n})\n```\n\n## Impact\n\n- Each stalled handshake consumes a goroutine and FD with no timeout and no server-side close.  \n- A malicious client can open many connections, send a minimal ClientHello with `acme-tls/1`, then stop responding, leading to denial of service of the entrypoint.  \n- Normal HTTPS handling uses `http.Server` timeouts; this bespoke path bypasses them.\n\n## Conditions for exploitation\n\n- ACME TLS-ALPN challenge enabled (default when configured).  \n- `allowACMEByPass` disabled for the entrypoint (the default when ACME TLS challenge is handled by Traefik).\n\n## CWE\n\n- CWE-400: Uncontrolled Resource Consumption.\n\n## Proposed fix (illustrative)\n\n```\n@@ func (r *Router) acmeTLSALPNHandler() tcp.Handler {\n-    return tcp.HandlerFunc(func(conn tcp.WriteCloser) {\n-        _ = tls.Server(conn, r.httpsTLSConfig).Handshake()\n-    })\n+    return tcp.HandlerFunc(func(conn tcp.WriteCloser) {\n+        // Ensure the handshake cannot block indefinitely and always closes the socket.\n+        _ = conn.SetReadDeadline(time.Now().Add(10 * time.Second))\n+        _ = conn.SetWriteDeadline(time.Now().Add(10 * time.Second))\n+\n+        tlsConn := tls.Server(conn, r.httpsTLSConfig)\n+        _ = tlsConn.Handshake()\n+        _ = tlsConn.Close() // close regardless of handshake outcome\n+    })\n }\n```\n\nAlternatively, route ACME TLS-ALPN through the existing `tcp.TLSHandler`/HTTP server path so the configured timeouts and lifecycle management apply automatically.\n\n## CVSS v3.1 (estimate)\n\n- Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H  \n- Base score: 7.5 (High)  \n- Rationale: Network-only, no auth/user interaction required; impact is service availability via resource exhaustion; no confidentiality or integrity impact.\n\nPlease let us know if you would like a PoC or further details. We have not made any code changes in this report.\n\nLet us know if you have any questions or need clarification\\!\n\nBest wishes,  \nPavel Kohout  \n Aisle Research  \n\u003c/details\u003e",
  "id": "GHSA-cwjm-3f7h-9hwq",
  "modified": "2026-01-16T15:20:43Z",
  "published": "2026-01-15T22:58:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-cwjm-3f7h-9hwq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22045"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/commit/e9f3089e9045812bcf1b410a9d40568917b26c3d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/traefik/traefik"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v2.11.35"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v3.6.7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Traefik\u0027s ACME TLS-ALPN fast path lacks timeouts and close on handshake stall"
}

OPENSUSE-SU-2026:10142-1

Vulnerability from csaf_opensuse - Published: 2026-02-03 00:00 - Updated: 2026-09-17 16:52

Summary

traefik-3.6.7-1.1 on GA media

Severity

Moderate

Scope

2 vulnerabilities in this advisory, including CVE-2026-22045.

CVE-2026-22045

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Recommended: 4 products

Open the full advisory

OPENSUSE-SU-2026:10143-1

Vulnerability from csaf_opensuse - Published: 2026-02-03 00:00 - Updated: 2026-09-17 16:52

Summary

traefik2-2.11.35-1.1 on GA media

Severity

Moderate

Scope

4 vulnerabilities in this advisory, including CVE-2026-22045.

CVE-2026-22045

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Recommended: 4 products

Open the full advisory

RHSA-2026:6192

Vulnerability from csaf_redhat - Published: 2026-03-30 15:41 - Updated: 2026-09-23 20:32

Summary

Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.27.0 Release.

Severity

Important

Scope

19 vulnerabilities in this advisory, including CVE-2026-22045.

CVE-2026-22045

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. This vulnerability exists in the ACME TLS-ALPN fast path, where unauthenticated clients can exploit it. By initiating numerous connections and sending a minimal ClientHello with "acme-tls/1" before ceasing communication, a malicious client can indefinitely tie up system resources such as "go routines" (lightweight threads) and file descriptors. This leads to a Denial of Service (DoS) of the entry point, making the service unavailable to legitimate users.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 4 products Known not affected: 57 products

https://access.redhat.com/errata/RHSA-2026:6192

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-22045 (GCVE-0-2026-22045)

CLEANSTART-2026-DQ38367 (CVE-2026-22045)

CLEANSTART-2026-QI45196 (CVE-2026-40611)

FKIE_CVE-2026-22045

GHSA-CWJM-3F7H-9HWQ

Impact

Patches

For more information

OPENSUSE-SU-2026:10142-1

OPENSUSE-SU-2026:10143-1

RHSA-2026:6192

Tags

Sightings

Nomenclature

Related by attack behaviour