Traefik STARTTLS Request Handling Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in Traefik, an HTTP reverse proxy and load balancer, in versions prior to 3.6.8. The issue arises in Traefik's management of STARTTLS requests for Postgres. An unauthenticated client can send the 8-byte Postgres SSLRequest prelude, bypassing Traefik's entrypoint read timeout. This exploitation allows connections to remain open indefinitely, causing a denial-of-service condition.

Impact

Exploitation of this vulnerability can lead to a denial-of-service condition, with connections being held open indefinitely.

Remediation

Users can upgrade to Traefik version 3.6.8 to address this vulnerability.