All vulnerabilities

Go

CVE-2026-25949

Traefik: TCP readTimeout bypass via STARTTLS on Postgres in github.com/traefik/traefik

Severity: Unrated
Published: 17 Feb 2026
Last changed: 25 Feb 2026
Added to UpHeron: 22 Oct 2026
Fixed in: 3.6.8
Also known as: GHSA-89p3-4642-cr2w, GO-2026-4484
Sources: OSV.dev and GitHub

Affected software

Software	Affected versions
github.com/traefik/traefikGo · `osv:Go:github.com/traefik/traefik`	Every version
TraefikGo · `osv:Go:github.com/traefik/traefik/v2`	Every version
TraefikGo · `osv:Go:github.com/traefik/traefik/v3`	Every version before 3.6.8

References

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-25949
GitHub Advisory Database https://github.com/advisories/GHSA-89p3-4642-cr2w
OSV.dev https://osv.dev/vulnerability/GO-2026-4484