7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25949

CVE-2026-25949: Traefik: TCP readTimeout bypass via STARTTLS on Postgres

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.8, there is a potential vulnerability in Traefik managing STARTTLS requests. An unauthenticated client can bypass Traefik entrypoint respondingTimeouts.readTimeout by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing connections to remain open indefinitely, leading to a denial of service. This vulnerability is fixed in 3.6.8.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25949

CVE-2026-25949:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/traefik/traefik/v3	go	<= 3.6.7	3.6.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows a remote, unauthenticated attacker to cause a denial of service by exhausting file descriptors and goroutines. This is achieved by sending an 8-byte Postgres SSLRequest (STARTTLS) prelude to a Traefik TCP entrypoint and then stalling.

The root cause is in the ServeTCP function within pkg/server/router/tcp/router.go. Upon detecting a Postgres request, this function would prematurely clear the connection's read timeout by calling conn.SetDeadline(time.Time{}). It would then pass the connection to the servePostgres handler in pkg/server/router/tcp/postgres.go.

The servePostgres function would then wait for the next part of the TLS handshake (the ClientHello). However, since the read deadline was already cleared, a malicious client could simply not send any more data, causing the servePostgres function to block indefinitely. Each stalled connection would consume a file descriptor and a goroutine, eventually exhausting the server's resources.

The patch rectifies this by removing the deadline-clearing logic from ServeTCP and moving it inside servePostgres. The deadline is now only cleared after the initial STARTTLS negotiation and ClientHello have been successfully read, ensuring that the connection cannot hang during this initial phase. Therefore, both Router.ServeTCP and Router.servePostgres are critical functions in the execution path of this vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.