CVE-2026-25949: Traefik's Eternal Wait: Bypassing TCP Timeouts with Postgres Magic Bytes

Source: Dev.to

Overview

Vulnerability ID: CVE-2026-25949
CVSS Score: 7.5 (High)
Published: 2026-02-12
CWE ID: CWE-400 (Uncontrolled Resource Consumption)
Attack Vector: Network (Remote)
Impact: Denial of Service (DoS)
Affected Protocol: TCP (Postgres STARTTLS)

Traefik, the cloud‑native edge router, trusts PostgreSQL connections too early. An unauthenticated attacker can bypass configured read timeouts by initiating a Postgres STARTTLS handshake and then stopping. By sending a specific 8‑byte sequence, the attacker forces Traefik to remove its safety deadlines, causing the server to keep the connection open indefinitely. A few thousand such “zombie” connections can exhaust file descriptors and goroutines, effectively bricking the load balancer.

Vulnerability Details

• Trigger: Send a Postgres SSLRequest header (0x0000000804D2162F) and then stall.
• Effect: Traefik indefinitely waits for a TLS ClientHello that never arrives, bypassing the readTimeout setting.
• Result: Resource exhaustion leading to a denial‑of‑service condition.

Affected Versions

Patch

The fix postpones setting the deadline for Postgres STARTTLS connections.

// pkg/server/router/tcp/router.go
if err := conn.SetDeadline(time.Time{}); err != nil {
    // handle error
}

• Patch Commit: 31e566e9f1d7888ccb6fbc18bfed427203c35678

Exploit Overview

The vulnerability is trivial to exploit with standard socket libraries:

1. Open a TCP connection to the Traefik listener.
2. Send the Postgres SSLRequest prelude (0x0000000804D2162F).
3. Stop sending further data, causing Traefik to wait indefinitely.

Remediation Steps

1. Upgrade Traefik to version 3.6.8 or later.

   docker pull traefik:v3.6.8

2. Update your docker‑compose.yml or Kubernetes manifests to reference the new image tag.
3. Redeploy the Traefik ingress controller.
4. Verify the fix by running the PoC script against a staging environment and confirming that the connection is terminated after the configured timeout.
5. (Optional) Implement connection.maxLessHost to limit connections per IP.
6. Configure strict idle timeouts on upstream load balancers (e.g., AWS ALB/NLB, Cloudflare).

References

• GHSA-89p3-4642-cr2w: Traefik Denial of Service via Postgres STARTTLS
• PostgreSQL Documentation: SSL Session Encryption
• Full CVE‑2026‑25949 report (interactive diagrams and exploit analysis) – available on the vendor’s website.