Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.8, there is a potential vulnerability in Traefik managing STARTTLS requests. An unauthenticated client can bypass Traefik entrypoint respondingTimeouts.readTimeout by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing connections to remain open indefinitely, leading to a denial of service. This vulnerability is fixed in 3.6.8.

Affected: Go: github.com/traefik/traefik/v3

## Impact

There is a potential vulnerability in Traefik managing STARTTLS requests.

An unauthenticated client can bypass Traefik entrypoint `respondingTimeouts.readTimeout` by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing connections to remain open indefinitely, leading to a denial of service.

## Patches

- https://github.com/traefik/traefik/releases/tag/v3.6.8

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

<details> <summary>Original Description</summary>

### Summary A remote, unauthenticated client can bypass Traefik entrypoint `respondingTimeouts.readTimeout` by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing connections to remain open indefinitely and enabling file-descriptor and goroutine exhaustion denial of service.

This triggers during protocol detection **before routing**, so it is reachable on an entrypoint even when **no Postgres/TCP routers are configured** (the PoC uses only an HTTP router).

### Details Traefik applies per-connection deadlines based on `entryPoints.<name>.transport.respondingTimeouts.readTimeout` to prevent protocol detection and request reads from blocking forever (see `pkg/server/server_entrypoint_tcp.go`, which sets `SetReadDeadline` on accepted connections).

However, in the TCP router protocol detection path (`pkg/server/router/tcp/router.go`), when Trae…

traefik-3.6.8-1.1 on GA media

lodash: prototype pollution in _.unset and _.omit functions traefik: Traefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate glob: glob: Command Injection Vulnerability via Malicious Filenames crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption ajv: ReDoS via $data reference io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files traefik: Traefik: Denial of Service via ACME TLS-ALPN fast path resource exhaustion node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check Fastify: Fastify: Validation bypass due to malformed Content-Type header leading to integrity impact axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig github.com/traefik/traefik: Traefik: Denial of Service via stalled STARTTLS requests node-tar: node-ta…