CVE-2026-25949: Traefik: TCP readTimeout bypass via STARTTLS on Postgres
(updated )
A remote, unauthenticated client can bypass Traefik entrypoint respondingTimeouts.readTimeout by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing connections to remain open indefinitely and enabling file-descriptor and goroutine exhaustion denial of service.
This triggers during protocol detection before routing, so it is reachable on an entrypoint even when no Postgres/TCP routers are configured (the PoC uses only an HTTP router).
References
- access.redhat.com/errata/RHSA-2026:6192
- access.redhat.com/security/cve/CVE-2026-25949
- bugzilla.redhat.com/show_bug.cgi?id=2439522
- github.com/advisories/GHSA-89p3-4642-cr2w
- github.com/traefik/traefik/commit/31e566e9f1d7888ccb6fbc18bfed427203c35678
- github.com/traefik/traefik/releases/tag/v3.6.8
- github.com/traefik/traefik/security/advisories/GHSA-89p3-4642-cr2w
- nvd.nist.gov/vuln/detail/CVE-2026-25949
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25949.json
Code Behaviors & Features
Detect and mitigate CVE-2026-25949 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →