Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing TLS handshake on TCP routers. When Traefik processes a TLS connection on a TCP router, the read deadline used to bound protocol sniffing is cleared before the TLS handshake is completed. When a TLS handshake read error occurs, the code attempts a second handshake with different connection parameters, silently ignoring the initial error. A remote unauthenticated client can exploit this by sending an incomplete TLS record and stopping further data transmission, causing the TLS handshake to stall indefinitely and holding connections open. By opening many such stalled connections in parallel, an attacker can exhaust file descriptors and goroutines, degrading availability of all services on the affected entrypoint. This issue has been patched in versions 2.11.38 and 3.6.9.

The version of Traefik installed on the remote macOS host is prior to 2.11.38 or 3.x prior to 3.6.9. It is, therefore, affected by multiple vulnerabilities:

  - A flaw exists in the ForwardAuth middleware due to the response body from the authentication server being     read entirely into memory without any size limit. An authenticated, remote attacker can exploit this to     cause a denial of service via an out-of-memory condition. (CVE-2026-26998)

  - A flaw exists in TLS handshake handling on TCP routers due to the read deadline being cleared before the     TLS handshake is completed. An unauthenticated, remote attacker can exploit this, via incomplete TLS     records, to cause a denial of service by exhausting file descriptors and goroutines. (CVE-2026-26999)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a
    potential vulnerability in Traefik managing TLS handshake on TCP routers. When Traefik processes a TLS
    connection on a TCP router, the read deadline used to bound protocol sniffing is cleared before the TLS
    handshake is completed. When a TLS handshake read error occurs, the code attempts a second handshake with
    different connection parameters, silently ignoring the initial error. A remote unauthenticated client can
    exploit this by sending an incomplete TLS record and stopping further data transmission, causing the TLS
    handshake to stall indefinitely and holding connections open. By opening many such stalled connections in
    parallel, an attacker can exhaust file descriptors and goroutines, degrading availability of all services
    on the affected entrypoint. This issue has been patched in versions 2.11.38 and 3.6.9. (CVE-2026-26999)

ID	Name	Product	Family	Severity
318671	Traefik < 2.11.38 / 3.x < 3.6.9 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
438308	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-xw98-5q62-jx94)	Tenable Cloud Security	SCA Checks	high
438308	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-xw98-5q62-jx94)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-26999

high

Tenable Plugins

high

high

high