CVE-2026-88012
CVE-2026-88012 · Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream deadline. An unauthenticated client can use a slow request body, trickling data indefinitely while holding a request and an upstream connection open and exhausting backends with bounded connection pools. This issue is fixed in 2.11.56 and 3.7.12.
CVSS 5.3 · Medium · EPSS 0.5%
- Published
- Updated
Stack: web
Affected products and versions
traefik
- Versions
- >= 2.8.2, < 2.11.56: Affected
- >= 3.0.0, < 3.7.12: Affected
No fix published
Original sources
- https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c
- https://github.com/traefik/traefik/pull/13717
- https://github.com/traefik/traefik/commit/a8d0bc425859dde7481a6c9a324e610b81d754d0
- https://github.com/traefik/traefik/releases/tag/v2.11.56
- https://github.com/traefik/traefik/releases/tag/v3.7.12
- https://nvd.nist.gov/vuln/detail/CVE-2026-88012