Traefik's ACME TLS-ALPN fast path is a resource‑exhaustion vulnerability that allows an unauthenticated client to bind goroutines and file descriptors indefinitely. The attacker can send a minimal ClientHello specifying acme‑tls/1 and then stop responding, causing the entry point to become saturated by long‑lived connections. This leads to a denial‑of‑service of the affected entry point as normal traffic cannot be served. The weakness maps to CWE‑770.

Affected installations include Traefik deployments running version 2.10.x through 2.11.34 and 3.4.x through 3.6.6. The vulnerability is present in all 2.x and 3.x releases before the updates to 2.11.35 and 3.6.7 respectively. Administrators using the ACME TLS challenge feature on their load balancer entry points are at risk.

The CVSS base score of 5.9 indicates a moderate severity, and the EPSS probability of fewer than 1% suggests that exploitation is unlikely in the current landscape. The flaw is not listed in CISA's KEV catalog. The attack surface is limited to clients that can initiate TLS handshakes on the entry point, thus the immediate risk is low but the potential for service disruption is real. Updating to the patched releases removes the vulnerability entirely.