CVE-2026-26998

Description

Traefik has unbounded io.ReadAll on auth server response body that causes OOM DOS in github.com/traefik/traefik

Affected packages (5)

• Go/github.com/traefik/traefikfrom 0
• Go/github.com/traefik/traefik/v2from 0, < 2.11.38
• Go/github.com/traefik/traefik/v2from 0, < 2.11.38
• Go/github.com/traefik/traefik/v3from 0, < 3.6.9
• Go/github.com/traefik/traefik/v3from 0, < 3.6.9

CVSS scores

References (5)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-26998
• PATCHhttps://github.com/traefik/traefik
• WEBhttps://github.com/traefik/traefik/releases/tag/v2.11.38
• WEBhttps://github.com/traefik/traefik/releases/tag/v3.6.9
• WEBhttps://github.com/traefik/traefik/security/advisories/GHSA-fw45-f5q2-2p4x