CVE-2026-26998
published 2026-03-05CVE-2026-26998: Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing the ForwardAuth…
PriorityP423medium4.4CVSS 3.1
AVNACHPRHUINSUCNINAH
EPSS
0.45%
35.9th percentile
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing the ForwardAuth middleware responses. When Traefik is configured to use the ForwardAuth middleware, the response body from the authentication server is read entirely into memory without any size limit. There is no maxResponseBodySize configuration to restrict the amount of data read from the authentication server response. If the authentication server returns an unexpectedly large or unbounded response body, Traefik will allocate unlimited memory, potentially causing an out-of-memory (OOM) condition that crashes the process. This results in a denial of service for all routes served by the affected Traefik instance. This issue has been patched in versions 2.11.38 and 3.6.9.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | traefik_traefik_v2 | >= 0 < 2.11.38 | 2.11.38 |
| github.com | traefik_traefik_v3 | >= 0 < 3.6.9 | 3.6.9 |
| traefik | traefik | < 3.6.9 | 3.6.9 |
| traefik | traefik | < 2.11.38 | 2.11.38 |
| traefik | traefik | >= 3.0.0 < 3.6.9 | 3.6.9 |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
vendor_redhat4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Traefik up to 2.11.37/3.6.8 allocation of resources (Nessus ID 318671)
vuldb·2026-06-05·CVSS 4.4
CVE-2026-26998 [MEDIUM] Traefik up to 2.11.37/3.6.8 allocation of resources (Nessus ID 318671)
A vulnerability was found in Traefik up to 2.11.37/3.6.8. It has been rated as problematic. This impacts an unknown function. This manipulation causes allocation of resources.
This vulnerability is tracked as CVE-2026-26998. The attack is possible to be carried out remotely. No exploit exists.
Upgrading the affected component is advised.
OSV
Traefik has unbounded io.ReadAll on auth server response body that causes OOM DOS in github.com/traefik/traefik
osv·2026-03-10
CVE-2026-26998 Traefik has unbounded io.ReadAll on auth server response body that causes OOM DOS in github.com/traefik/traefik
Traefik has unbounded io.ReadAll on auth server response body that causes OOM DOS in github.com/traefik/traefik
Traefik has unbounded io.ReadAll on auth server response body that causes OOM DOS in github.com/traefik/traefik
GHSA
Traefik has unbounded io.ReadAll on auth server response body that causes OOM DOS
ghsa·2026-03-04
CVE-2026-26998 [MEDIUM] CWE-770 Traefik has unbounded io.ReadAll on auth server response body that causes OOM DOS
Traefik has unbounded io.ReadAll on auth server response body that causes OOM DOS
## Impact
There is a potential vulnerability in Traefik managing the ForwardAuth middleware responses.
When Traefik is configured to use the ForwardAuth middleware, the response body from the authentication server is read entirely into memory without any size limit. There is no `maxResponseBodySize` configuration to restrict the amount of data read from the authentication server response. If the authentication server returns an unexpectedly large or unbounded response body, Traefik will allocate unlimited memory, potentially causing an out-of-memory (OOM) condition that crashes the process.
This results in a denial of service for all routes served by the affected Traefik instance.
## Patches
- https://g
OSV
Traefik has unbounded io.ReadAll on auth server response body that causes OOM DOS
osv·2026-03-04
CVE-2026-26998 [MEDIUM] Traefik has unbounded io.ReadAll on auth server response body that causes OOM DOS
Traefik has unbounded io.ReadAll on auth server response body that causes OOM DOS
## Impact
There is a potential vulnerability in Traefik managing the ForwardAuth middleware responses.
When Traefik is configured to use the ForwardAuth middleware, the response body from the authentication server is read entirely into memory without any size limit. There is no `maxResponseBodySize` configuration to restrict the amount of data read from the authentication server response. If the authentication server returns an unexpectedly large or unbounded response body, Traefik will allocate unlimited memory, potentially causing an out-of-memory (OOM) condition that crashes the process.
This results in a denial of service for all routes served by the affected Traefik instance.
## Patches
- https://g
Red Hat
github.com/traefik/traefik: Traefik: Denial of Service due to unbounded ForwardAuth middleware response processing
vendor_redhat·2026-03-05·CVSS 4.4
CVE-2026-26998 [MEDIUM] CWE-770 github.com/traefik/traefik: Traefik: Denial of Service due to unbounded ForwardAuth middleware response processing
github.com/traefik/traefik: Traefik: Denial of Service due to unbounded ForwardAuth middleware response processing
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing the ForwardAuth middleware responses. When Traefik is configured to use the ForwardAuth middleware, the response body from the authentication server is read entirely into memory without any size limit. There is no maxResponseBodySize configuration to restrict the amount of data read from the authentication server response. If the authentication server returns an unexpectedly large or unbounded response body, Traefik will allocate unlimited memory, potentially causing an out-of-memory (OOM) condition that crashes the process. This resu
No detection rules found.
No public exploits indexed.
2026-03-05
Published