Все бюллетени/p10/ALT-PU-2026-1985-4
ALT-PU-2026-1985-4

Обновление пакета traefik в ветке p10

Версия3.6.7-alt1
Задание#406617
Опубликовано2026-02-04
Макс. серьёзностьHIGH
Серьёзность:

Закрытые проблемы (2)

CVE-2026-22045
HIGH7.5

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.35 and 3.6.7, there is a potential vulnerability in Traefik ACME TLS certificates' automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up go routines and file descriptors indefinitely when the ACME TLS challenge is enabled. A malicious client can open many connections, send a minimal ClientHello with acme-tls/1, then stop responding, leading to denial of service of the entry point. The vulnerability is fixed in 2.11.35 and 3.6.7.

Опубликовано: 2026-01-15Изменено: 2026-01-23
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GHSA-cwjm-3f7h-9hwq
MEDIUM5.9

Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall

Опубликовано: 2026-01-16Изменено: 2026-01-16
CVSS 3.xСРЕДНЯЯ 5.9
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H