Traefik versions prior to 3.6.8 contain a critical denial of service vulnerability that allows unauthenticated remote attackers to exhaust system resources by stalling TCP connections.

This vulnerability is a resource consumption flaw (CWE-400) where an unauthenticated attacker can bypass read timeouts by sending a specific 8-byte Postgres SSLRequest prelude and subsequently stalling the connection. This prevents the entrypoint from closing the connection, leading to resource exhaustion.

Successful exploitation of this vulnerability results in a denial of service, rendering the reverse proxy unable to process legitimate traffic for other services. With a CVSS score of 7.5, this high-severity flaw poses a significant risk to service availability, potentially leading to operational disruption and loss of business continuity for environments relying on Traefik for traffic management.

Immediate Action: Upgrade Traefik to version 3.6.8 or later to incorporate the patch that correctly enforces read timeouts for STARTTLS requests.

Proactive Monitoring: Monitor infrastructure logs and metrics for an unusual spike in open connections or prolonged connection durations at the entrypoint level.

Compensating Controls: Implement rate limiting and connection limiting at the infrastructure or firewall level to mitigate the impact of stalled connections while the upgrade process is underway.

Public Exploit Available: No (exploit_available: false)

Given the ease of exploitation and the potential for service disruption, administrators should prioritize updating to version 3.6.8 immediately. As this is an unauthenticated remote vulnerability, it is essential to ensure that all internet-facing instances are patched to maintain service availability and prevent potential service degradation.