CVE-2026-22045
📋 TL;DR
This vulnerability allows unauthenticated attackers to cause denial of service in Traefik reverse proxy by exploiting the ACME TLS-ALPN challenge mechanism. Attackers can open numerous connections and leave them hanging, consuming server resources indefinitely. This affects all Traefik deployments with ACME TLS challenge enabled prior to versions 2.11.35 and 3.6.7.
💻 Affected Systems
- Traefik
📦 What is this software?
Traefik by Traefik
Traefik by Traefik
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for the affected entry point, making services behind Traefik unreachable until resource exhaustion is resolved.
Likely Case
Degraded performance and intermittent service disruptions as go routines and file descriptors are consumed.
If Mitigated
Minimal impact if ACME TLS challenge is disabled or if connections are rate-limited.
🎯 Exploit Status
Exploitation requires minimal technical skill - just opening connections with specific ClientHello and not responding.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.11.35 or 3.6.7
Vendor Advisory: https://github.com/traefik/traefik/security/advisories/GHSA-cwjm-3f7h-9hwq
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Stop Traefik service. 3. Update to Traefik 2.11.35 or 3.6.7. 4. Restart Traefik service. 5. Verify functionality.
🔧 Temporary Workarounds
Disable ACME TLS-ALPN challenge
allSwitch to HTTP-01 or DNS-01 challenge methods instead of TLS-ALPN
# In Traefik configuration, set:
# [certificatesResolvers.myresolver.acme]
# tlsChallenge = false
# httpChallenge = true
Rate limit connections
linuxImplement connection rate limiting at network or application level
# Using iptables example:
# iptables -A INPUT -p tcp --dport 443 -m connlimit --connlimit-above 100 -j DROP
🧯 If You Can't Patch
- Disable ACME TLS challenge entirely and use alternative certificate management
- Implement strict network ACLs to limit who can connect to Traefik entry points
🔍 How to Verify
Check if Vulnerable:
Check Traefik version and ACME configuration. If version < 2.11.35 or < 3.6.7 AND tlsChallenge is enabled, system is vulnerable.Check Version:
traefik versionVerify Fix Applied:
Confirm Traefik version is 2.11.35 or higher (v2) or 3.6.7 or higher (v3) and monitor for connection exhaustion.📡 Detection & Monitoring
Log Indicators:
- Unusually high number of TLS handshake timeouts
- ACME TLS-ALPN challenge failures
- Resource exhaustion warnings
Network Indicators:
- Multiple connections on port 443 with incomplete TLS handshakes
- Sustained connections with minimal ClientHello data
SIEM Query:
source="traefik" AND ("tls-alpn" OR "acme") AND ("timeout" OR "failed" OR "exhausted")