CVE-2026-22045: 
NixOS vulnerability analysis and mitigation

CVE-2026-22045 is a denial-of-service vulnerability in Traefik's ACME TLS-ALPN challenge handling, where the fast path lacks connection timeouts and socket closure on handshake stall. Discovered and reported by Pavel Kohout of Aisle Research, it was disclosed on January 15, 2026. Affected versions include Traefik v2.x up to and including v2.11.34, and v3.0.0 through v3.6.6. The GitHub Advisory Database assigns a CVSS v3.1 score of 5.9 (Moderate), while the original reporter estimated 7.5 (High) (GitHub Advisory, Traefik Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) / CWE-400 (Uncontrolled Resource Consumption) in pkg/server/router/tcp/router.go. When a TLS ClientHello advertises the acme-tls/1 ALPN protocol, Traefik's fast path intercepts the connection and calls tls.Server(...).Handshake() without any read/write deadlines and without closing the connection afterward. Critically, existing entrypoint-level deadlines are explicitly cleared just before this branch executes, meaning the bespoke ACME path entirely bypasses the timeouts applied to normal HTTPS handling. An unauthenticated attacker can open many connections, send a minimal ClientHello with acme-tls/1, and then stop responding — each stalled handshake permanently consumes a goroutine and a file descriptor with no server-side reclamation (GitHub Advisory, Patch Commit).

Successful exploitation causes denial of service of the affected Traefik entrypoint by exhausting goroutines and file descriptors. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Exploitation is limited to entrypoints where the ACME TLS-ALPN challenge is enabled and allowACMEByPass is disabled (both are the default configuration when ACME TLS challenge is handled by Traefik), meaning publicly exposed Traefik instances using automatic certificate provisioning are at risk (Traefik Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.011% (6th percentile), indicating a low near-term exploitation probability (GitHub Advisory). No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing Traefik instances running versions ≤ v2.11.34 or v3.0.0–v3.6.6 using tools like Shodan or Censys, looking for services with ACME TLS-ALPN challenge enabled (typically port 443).
2. Craft minimal ClientHello: Construct a TLS ClientHello message that includes acme-tls/1 in the ALPN extension. A minimal truncated record (e.g., TLS record header 0x16 0x03 0x01 followed by a short payload) is sufficient to trigger the fast path.
3. Open many connections: Using a scripted tool (e.g., a simple Go or Python script), open a large number of simultaneous TCP connections to the target entrypoint and send the crafted ClientHello on each.
4. Stop responding: After sending the ClientHello, cease all further communication on each connection. Because Traefik's ACME fast path sets no read/write deadlines and never closes the connection server-side, each connection holds a goroutine and file descriptor indefinitely.
5. Achieve denial of service: As goroutines and file descriptors accumulate, the entrypoint becomes unable to accept or process new legitimate connections, resulting in service unavailability (Traefik Advisory, Patch Commit).

• Network: Large number of simultaneous inbound TLS connections to the Traefik entrypoint (port 443) that complete a ClientHello but never progress to a full handshake; connections remaining open indefinitely from diverse or single source IPs.
• Process/Runtime: Rapidly growing goroutine count in Traefik metrics (e.g., go_goroutines Prometheus metric); file descriptor exhaustion visible via lsof or /proc/<pid>/fd.
• Logs: Traefik debug logs showing repeated Error during ACME-TLS/1 handshake entries (post-patch) or absence of handshake completion logs for many connections; entrypoint becoming unresponsive to new connections.
• System: OS-level alerts for file descriptor limits being reached (e.g., too many open files errors in system logs); elevated TCP connection counts in ss -s or netstat output with many connections in ESTABLISHED state to the Traefik port (Traefik Advisory).

Traefik has released patched versions v2.11.35 (for the v2.x branch) and v3.6.7 (for the v3.x branch), both of which add a 2-second context timeout to the ACME-TLS/1 handshake and ensure the connection is always closed after the handshake attempt (Traefik v2.11.35 Release, Traefik v3.6.7 Release). Upgrading to these versions is the recommended remediation. As a temporary workaround where immediate patching is not possible, operators can implement network-level access controls (e.g., firewall rules or IP allowlists) to restrict which clients can reach the ACME TLS-ALPN challenge entrypoint, or enable allowACMEByPass to route ACME challenges through an external provider rather than Traefik itself (GitHub Advisory).

The vulnerability was responsibly disclosed by Pavel Kohout of Aisle Research and acknowledged by the Traefik maintainer nmengin, who published the advisory and patches on January 15, 2026 (Traefik Advisory). The v3.6.7 release notes received positive community engagement on GitHub with 25 reactions, suggesting the patch was well-received by the Traefik user community (Traefik v3.6.7 Release). No significant broader media coverage or notable independent researcher commentary has been identified beyond the official advisory.