CVE-2026-22045 — Allocation of Resources Without Limits or Throttling in Traefik

CWE-770 — Allocation of Resources Without Limits or Throttling7 documents6 sources
Severity
7.5HIGHNVD
CNA5.9
EPSS
0.0%
top 95.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
TraefikGithub.com Traefik Traefik V2Github.com Traefik Traefik V3
Timeline
PublishedJan 15
Latest updateJan 23

Description

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.35 and 3.6.7, there is a potential vulnerability in Traefik ACME TLS certificates' automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up go routines and file descriptors indefinitely when the ACME TLS challenge is enabled. A malicious client can open many connections, send a minimal ClientHello with acme-tls/1, then stop responding, leading to denial of service of the entry point. The vulner…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5traefik/traefik< 2.11.35+1
▶NVDtraefik/traefik3.0.0 — 3.6.7+1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall in github.com/traefik/traefik↗2026-01-23
▶
CVEList
Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall↗2026-01-15
▶
GHSA
Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall↗2026-01-15
▶
OSV
Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall↗2026-01-15
▶

📋Vendor Advisories

1
Red Hat
traefik: Traefik: Denial of Service via ACME TLS-ALPN fast path resource exhaustion↗2026-01-15
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-22045 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-22045 — Traefik vulnerability | cvebase