GHSA-XW98-5Q62-JX94 Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (Slowloris DOS)

Impact There is a potential vulnerability in Traefik managing TLS handshake on TCP routers. When Traefik processes a TLS connection on a TCP router, the read deadline used to bound protocol sniffing is cleared before the TLS handshake is completed. When a TLS handshake read error occurs, the code...

Traefik has unbounded io.ReadAll on auth server response body that causes OOM DOS

Impact There is a potential vulnerability in Traefik managing the ForwardAuth middleware responses. When Traefik is configured to use the ForwardAuth middleware, the response body from the authentication server is read entirely into memory without any size limit. There is no maxResponseBodySize...

GHSA-FW45-F5Q2-2P4X Traefik has unbounded io.ReadAll on auth server response body that causes OOM DOS

Impact There is a potential vulnerability in Traefik managing the ForwardAuth middleware responses. When Traefik is configured to use the ForwardAuth middleware, the response body from the authentication server is read entirely into memory without any size limit. There is no maxResponseBodySize...

PT-2026-23084

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.11.38 and versions prior to 3.6.9 Description Traefik, an HTTP reverse proxy and load balancer, has an issue in its handling of TLS handshakes on TCP routers. The read deadline used for protocol sniffing is cleared...

PT-2026-23092

Name of the Vulnerable Software and Affected Versions Traefik versions 2.11.9 through 2.11.37 Traefik versions 3.1.3 through 3.6.8 Description Traefik, an HTTP reverse proxy and load balancer, has an issue in how it manages the Connection header in conjunction with X-Forwarded headers. When...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: src, kube-rbac-proxy, pulumi, ollama, opentelemetry-collector-contrib, crossplane-provider-aws-sqs, terraform-provider-grafana, caddy, cert-manager-webhook-pdns, pulumi-language-dotnet, timoni, trivy, vertical-pod-autoscaler, crossplane-provider-aws-kms, k3s,...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: src, kube-rbac-proxy, pulumi, ollama, opentelemetry-collector-contrib, crossplane-provider-aws-sqs, terraform-provider-grafana, caddy, cert-manager-webhook-pdns, pulumi-language-dotnet, timoni, trivy, vertical-pod-autoscaler, crossplane-provider-aws-kms, k3s,...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: zarf, splunk-otel-collector-fips, flux-fips, cluster-api-azure-controller, opentelemetry-collector-contrib, crossplane-provider-aws-memorydb, crossplane-provider-aws-cloudformation-fips, crossplane-provider-aws-s3, azure-service-operator, kyverno-policy-reporter-fips...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: zarf, splunk-otel-collector-fips, flux-fips, cluster-api-azure-controller, opentelemetry-collector-contrib, crossplane-provider-aws-memorydb, crossplane-provider-aws-cloudformation-fips, crossplane-provider-aws-s3, azure-service-operator, kyverno-policy-reporter-fips...

GHSA-89P3-4642-CR2W vulnerabilities

Vulnerabilities for packages: traefik-fips, traefik...

CVE-2026-25949 vulnerabilities

Vulnerabilities for packages: traefik-fips, traefik...

GO-2026-4530 Traefik affected by TLS ClientAuth Bypass on HTTP/3 in github.com/traefik/traefik

Traefik affected by TLS ClientAuth Bypass on HTTP/3 in github.com/traefik/traefik...

Traefik affected by TLS ClientAuth Bypass on HTTP/3

Summary There is a potential vulnerability in Traefik managing HTTP/3 connections. More details in the CVE-2025-68121. Patches - https://github.com/traefik/traefik/releases/tag/v2.11.37 - https://github.com/traefik/traefik/releases/tag/v3.6.8 Workarounds No workaround For more information If you...

GHSA-GV8R-9RW9-9697 Traefik affected by TLS ClientAuth Bypass on HTTP/3

Summary There is a potential vulnerability in Traefik managing HTTP/3 connections. More details in the CVE-2025-68121. Patches - https://github.com/traefik/traefik/releases/tag/v2.11.37 - https://github.com/traefik/traefik/releases/tag/v3.6.8 Workarounds No workaround For more information If you...

traefik-3.6.8-1.1 on GA media (moderate)

traefik-3.6.8-1.1 on GA media Announcement ID: openSUSE-SU-2026:10217-1 Rating: moderate Cross-References: CVE-2026-25949 CVSS scores: CVE-2026-25949 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-25949 SUSE : 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N...

GO-2026-4484 Traefik: TCP readTimeout bypass via STARTTLS on Postgres in github.com/traefik/traefik

Traefik: TCP readTimeout bypass via STARTTLS on Postgres in github.com/traefik/traefik...

OPENSUSE-SU-2026:10217-1 traefik-3.6.8-1.1 on GA media

These are all security issues fixed in the traefik-3.6.8-1.1 package on the GA media of openSUSE Tumbleweed...

FreeBSD : traefik -- TCP readTimeout bypass via STARTTLS on Postgres (590979aa-09f7-11f1-a730-5404a68ad561)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 590979aa-09f7-11f1-a730-5404a68ad561 advisory. The traefik project reports: There is a potential vulnerability in Traefik managing STARTTLS requests. ...

CVE-2026-25748

authentik is an open-source identity provider. Prior to 2025.10.4 and 2025.12.4, with a malformed cookie it was possible to bypass authentication when using forward authentication in the authentik Proxy Provider when used in conjunction with Traefik or Caddy as reverse proxy. When a malicious...

SUSE CVE-2026-25949

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.8, there is a potential vulnerability in Traefik managing STARTTLS requests. An unauthenticated client can bypass Traefik entrypoint respondingTimeouts.readTimeout by sending the 8-byte Postgres SSLRequest STARTTLS prelude and then...