CVE-2026-88012
CVE-2026-88012 · Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream deadline. An unauthenticated client can use a slow request body, trickling data indefinitely while holding a request and an upstream connection open and exhausting backends with bounded connection pools. This issue is fixed in 2.11.56 and 3.7.12.
CVSS 5.3 · Media · EPSS 0,5%
- Publicación
- Actualización
Pila tecnológica: web
Productos y versiones afectados
traefik
- Versiones
- >= 2.8.2, < 2.11.56: Afectada
- >= 3.0.0, < 3.7.12: Afectada
Sin corrección publicada
Fuentes originales
- https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c
- https://github.com/traefik/traefik/pull/13717
- https://github.com/traefik/traefik/commit/a8d0bc425859dde7481a6c9a324e610b81d754d0
- https://github.com/traefik/traefik/releases/tag/v2.11.56
- https://github.com/traefik/traefik/releases/tag/v3.7.12
- https://nvd.nist.gov/vuln/detail/CVE-2026-88012