CVE-2026-88012
CVE-2026-88012 · Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream deadline. An unauthenticated client can use a slow request body, trickling data indefinitely while holding a request and an upstream connection open and exhausting backends with bounded connection pools. This issue is fixed in 2.11.56 and 3.7.12.
CVSS 5.3 · Mittel · EPSS 0,5%
- Veröffentlicht
- Aktualisiert
Technologie-Stack: web
Betroffene Produkte und Versionen
traefik
- Softwareversionen
- >= 2.8.2, < 2.11.56: Betroffen
- >= 3.0.0, < 3.7.12: Betroffen
Keine Korrektur veröffentlicht
Originalquellen
- https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c
- https://github.com/traefik/traefik/pull/13717
- https://github.com/traefik/traefik/commit/a8d0bc425859dde7481a6c9a324e610b81d754d0
- https://github.com/traefik/traefik/releases/tag/v2.11.56
- https://github.com/traefik/traefik/releases/tag/v3.7.12
- https://nvd.nist.gov/vuln/detail/CVE-2026-88012