CVE-2026-26999: Traefik TLS Handshake DoS Vulnerability

CVE-2026-26999 Overview

CVE-2026-26999 is a high-severity Denial of Service (DoS) vulnerability affecting Traefik, a popular HTTP reverse proxy and load balancer. The vulnerability exists in how Traefik manages TLS handshakes on TCP routers. When processing a TLS connection, the read deadline used to bound protocol sniffing is cleared before the TLS handshake completes. If a TLS handshake read error occurs, the code attempts a second handshake with different connection parameters while silently ignoring the initial error.

A remote unauthenticated attacker can exploit this vulnerability by sending an incomplete TLS record and halting further data transmission. This causes the TLS handshake to stall indefinitely, holding connections open. By opening many such stalled connections in parallel, an attacker can exhaust file descriptors and goroutines, degrading the availability of all services on the affected entrypoint.

Critical Impact

Remote unauthenticated attackers can cause widespread service disruption by exhausting server resources through stalled TLS connections, impacting all services on the affected Traefik entrypoint.

Affected Products

• Traefik versions prior to 2.11.38
• Traefik versions prior to 3.6.9

Discovery Timeline

• 2026-03-05 - CVE-2026-26999 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-26999

Vulnerability Analysis

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption). The flaw resides in Traefik's TLS handshake handling mechanism for TCP routers. The core issue stems from improper deadline management during the TLS protocol negotiation phase.

When Traefik receives an incoming TLS connection on a TCP router, it uses a read deadline to limit the time allowed for protocol sniffing operations. However, this deadline is prematurely cleared before the TLS handshake reaches completion. Additionally, when a TLS handshake error is encountered, the implementation attempts a fallback handshake with alternate connection parameters without properly handling or logging the original failure.

This design flaw creates an opportunity for resource exhaustion attacks. An attacker can initiate numerous TLS connections, send partial TLS records, and then cease transmission. Each of these incomplete connections remains open indefinitely, consuming server resources including file descriptors and goroutines. As these resources become exhausted, legitimate traffic to all services configured on the same entrypoint is impacted.

Root Cause

The root cause of CVE-2026-26999 lies in the improper handling of connection timeouts during the TLS handshake phase. Specifically:

1. The read deadline mechanism used for protocol sniffing is cleared too early in the connection lifecycle
2. Error handling during TLS handshake failures allows silent retry without proper timeout enforcement
3. No mechanism exists to detect and terminate stalled connections that never complete the handshake

This combination allows connections to remain in an incomplete state indefinitely, making resource exhaustion attacks trivial to execute.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability remotely by:

1. Initiating multiple TCP connections to a Traefik entrypoint configured with TLS
2. Sending partial or incomplete TLS client hello records
3. Stopping transmission before the handshake completes
4. Repeating this process to accumulate stalled connections

As more connections stall, the Traefik server progressively loses available file descriptors and goroutines. Once these resources are depleted, the server cannot accept new legitimate connections, resulting in a denial of service condition affecting all services behind the affected entrypoint.

The attack does not require sophisticated tools or deep knowledge of the TLS protocol—basic socket programming capabilities are sufficient to craft the malicious connection pattern.

Detection Methods for CVE-2026-26999

Indicators of Compromise

• Abnormally high number of connections in SYN_RECV or partially established TLS states
• Spike in file descriptor usage on Traefik processes without corresponding increase in completed requests
• Goroutine count increasing steadily over time without corresponding throughput
• Connection timeout errors in application logs for services behind Traefik

Detection Strategies

• Monitor Traefik process file descriptor counts using /proc/[pid]/fd on Linux systems
• Implement alerting on goroutine metrics available via Traefik's metrics endpoint
• Deploy network intrusion detection rules to identify patterns of incomplete TLS handshakes from single sources
• Analyze connection state tables for unusual accumulation of half-open TLS connections

Monitoring Recommendations

• Configure connection monitoring with thresholds for concurrent incomplete TLS handshakes
• Implement rate limiting on new TLS connection attempts per source IP at the network layer
• Enable verbose logging for TLS handshake events to capture attempted exploitation
• Set up automated alerting when Traefik's resource utilization exceeds normal operational baselines

How to Mitigate CVE-2026-26999

Immediate Actions Required

• Upgrade Traefik to version 2.11.38 or later for the 2.x branch
• Upgrade Traefik to version 3.6.9 or later for the 3.x branch
• Review and implement connection rate limiting at the network perimeter
• Monitor Traefik instances for signs of active exploitation

Patch Information

Traefik has released security patches that address this vulnerability:

• Version 2.11.38: Fixes the TLS handshake timeout issue for the 2.x release branch. See the GitHub Traefik Release v2.11.38 for details.
• Version 3.6.9: Fixes the TLS handshake timeout issue for the 3.x release branch. See the GitHub Traefik Release v3.6.9 for details.

For complete technical details about this vulnerability, refer to the GitHub Security Advisory GHSA-xw98-5q62-jx94.

Workarounds

• Implement network-level rate limiting on incoming TLS connections per source IP
• Deploy a Web Application Firewall (WAF) or DDoS protection service in front of Traefik
• Configure operating system limits to provide isolation between Traefik entrypoints
• Consider temporarily disabling non-critical TLS-enabled TCP routers until patching is complete

# Example: Configure connection limits using iptables
# Limit new TLS connections to 50 per second per source IP on port 443
iptables -A INPUT -p tcp --dport 443 --syn -m connlimit --connlimit-above 50 --connlimit-mask 32 -j DROP

# Alternatively, use hashlimit to rate limit connection attempts
iptables -A INPUT -p tcp --dport 443 --syn -m hashlimit --hashlimit-above 50/sec --hashlimit-burst 100 --hashlimit-mode srcip --hashlimit-name tls_conn_limit -j DROP