A vulnerability in Traefik allows unauthenticated remote attackers to trigger a denial of service by exhausting system resources through stalled TLS handshake connections.

This is an uncontrolled resource consumption flaw (CWE-400) where the read deadline for protocol sniffing is cleared prematurely. An unauthenticated attacker can exploit this by sending incomplete TLS records to stall connections and exhaust file descriptors and goroutines.

The successful exploitation of this vulnerability results in a denial of service for all services hosted on the affected entrypoint. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to operational continuity, as attackers can easily render critical infrastructure inaccessible to legitimate users.

Immediate Action: Upgrade Traefik instances to version 2.11.38 or 3.6.9 immediately to incorporate the necessary TLS handshake handling fixes.

Proactive Monitoring: Monitor system resource usage, specifically file descriptor counts and goroutine levels, for sudden spikes or anomalies that could indicate an ongoing connection-exhaustion attack.

Compensating Controls: Implement rate limiting and aggressive connection timeouts on ingress traffic as a temporary measure to mitigate the impact of stalled connection attempts until patching is complete.

Public Exploit Available: Unknown.

Organizations relying on Traefik for traffic management must prioritize this update to prevent potential service outages. Administrators should verify their current deployment versions and apply the recommended patches immediately, as the vulnerability is readily automatable and poses a direct threat to system availability.