An attacker who can establish an unauthenticated TCP connection to a Traefik entrypoint may send a PostgreSQL STARTTLS prelude and then stop responding. Traefik’s readTimeout configured on that entrypoint is bypassed, so the connection stays open indefinitely, consuming server resources until the system is overwhelmed or services become unavailable.

Traefik instances running any version prior to 3.6.8 on any supported platform are vulnerable. The issue resides in the handling of STARTTLS requests in the TCP proxy layer.

The CVSS score of 7.5 indicates a high denial‑of‑service risk. The EPSS score is under 1%, suggesting exploitation is unlikely at present, and the vulnerability is not listed in CISA’s KEV catalog. An attacker only needs network access to the affected TCP port and can exploit the flaw with a simple STARTTLS packet, without authentication or privileged credentials. The weakness involves uncontrolled resource consumption (CWE‑400) and potential memory allocation over‑commitment (CWE‑770).