Traefik, an HTTP reverse proxy and load balancer, has a flaw affecting TLS handshake handling on TCP routers. During a TCP‑based TLS connection, the router clears the read deadline before completing the handshake. When a read error occurs, the code silently retries with a different set of parameters without reporting the initial failure. This allows a remote, unauthenticated client to send a truncated TLS record and terminate data transmission, causing the handshake to stall forever. The stalled connections consume file descriptors and goroutines, ultimately exhausting system resources and degrading the availability of all services behind the affected entrypoint. The weakness is classified as resource exhaustion (CWE‑400) and improper release of a resource (CWE‑772).

The vulnerability affects all versions of Traefik prior to 2.11.38 and 3.6.9. Any deployment of the Traefik reverse proxy or load balancer that uses TCP routing with TLS termination and is running an earlier release is potentially impacted.

The CVSS score is 7.5, indicating a high severity issue. The EPSS score is below 1%, reflecting very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network‑based, unauthenticated client that establishes a TLS connection to a vulnerable entrypoint and deliberately sends an incomplete TLS record, causing the server to stall processing. If an attacker opens many such connections concurrently, the server can exhaust file descriptors and goroutines, leading to a denial of service for all users on the affected entrypoint.