Most recent entries from all

CLEANSTART-2026-DQ38367 — Security fix for CVE-2026-22045 applied in: forecastle 1.0.159-r1

Affected: CleanStart: forecastle

Security vulnerability affects the forecastle package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-266067

fkie_cve-2026-22045

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.35 and 3.6.7, there is a potential vulnerability in Traefik ACME TLS certificates' automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up go routines and file descriptors indefinitely when the ACME TLS challenge is enabled. A malicious client can open many connections, send a minimal ClientHello with acme-tls/1, then stop responding, leading to denial of service of the entry point. The vulnerability is fixed in 2.11.35 and 3.6.7.

GHSA-cwjm-3f7h-9hwq — Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall

Affected: Go: github.com/traefik/traefik/v3, Go: github.com/traefik/traefik/v2

## Impact

There is a potential vulnerability in Traefik ACME TLS certificates' automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up goroutines and file descriptors indefinitely when the ACME TLS challenge is enabled.

A malicious client can open many connections, send a minimal ClientHello with `acme-tls/1`, then stop responding, leading to denial of service of the entrypoint.

## Patches

- https://github.com/traefik/traefik/releases/tag/v2.11.35 - https://github.com/traefik/traefik/releases/tag/v3.6.7

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

<details> <summary>Original Description</summary>

# \[Security\] ACME TLS-ALPN fast path lacks timeouts and close on handshake stall

Dear Traefik security team,

We believe we have identified a resource-exhaustion issue in the ACME TLS-ALPN fast path that can allow unauthenticated clients to tie up goroutines and file descriptors indefinitely when the ACME TLS challenge is enabled.

## Summary

- Affected code: `pkg/server/router/tcp/router.go` (ACME TLS-ALPN handling). - When a ClientHello advertises `acme-tls/1`, Traefik intercepts it and calls `tls.Server(...).Handshake()` without any read/write deadlines and without closing the connection afterward. - Immediately before this branch, existing deadlines set by the entrypoint are cleared. - A client that sends the ALPN mark…

openSUSE-SU-2026:10142-1 — traefik-3.6.7-1.1 on GA media

traefik-3.6.7-1.1 on GA media

RHSA-2026:6192 — Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.27.0 Release.

lodash: prototype pollution in _.unset and _.omit functions traefik: Traefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate glob: glob: Command Injection Vulnerability via Malicious Filenames crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption ajv: ReDoS via $data reference io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files traefik: Traefik: Denial of Service via ACME TLS-ALPN fast path resource exhaustion node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check Fastify: Fastify: Validation bypass due to malformed Content-Type header leading to integrity impact axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig github.com/traefik/traefik: Traefik: Denial of Service via stalled STARTTLS requests node-tar: node-ta…