Go/github.com/traefik/traefik CVE-2026-26999: high 7.5, EPSS 0.61%

Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (Slowloris DOS) in github.com/traefik/traefik

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-4594
• nvd: CVE-2026-26999
• https://github.com/traefik/traefik/security/advisories/GHSA-xw98-5q62-jx94
• https://github.com/traefik/traefik/releases/tag/v2.11.38
• https://github.com/traefik/traefik/releases/tag/v3.6.9

CVE-2026-26999 · published 2026-03-10T18:28:10Z · modified 2026-04-16T02:14:29.697878015Z · JSON