Executive brief
Traefik is a reverse proxy and load balancer used to route incoming traffic to backend services. The HTTP/3 protocol support in Traefik does not enforce the configured request read timeout, allowing clients to hold connections open indefinitely by trickling data slowly. This permits a small number of unauthenticated clients to exhaust backend connection pools and cause denial of service.
Technical details
The `respondingTimeouts.readTimeout` configuration parameter in Traefik is documented to limit the time to read an entire HTTP request including its body, with a default of 60 seconds. This timeout is enforced on HTTP/1.1 and HTTP/2 connections via a TCP-level read deadline, but it does not apply to HTTP/3 (QUIC) connections because QUIC is stream-based rather than TCP-based, and Traefik's HTTP/3 server implementation (`http3.Server`) is constructed without any timeout configuration. An unauthenticated attacker can send HTTP/3 requests with very slow body uploads (e.g., one byte every few seconds), holding each upstream connection for as long as desired with minimal client resource overhead. Affected versions are Traefik v2.8.2–v2.10.x and v3.0–v3.6. The vulnerability was introduced in v2.8.2 due to a quic-go API change that removed the embedded `http.Server` which previously carried timeouts. Patches are available in v2.11.56 and v3.7.12.
Affected products
- Traefik Traefik 2.8.2 to 2.10.x, 3.0 to 3.6
Timeline
- 2026-08-27: disclosed: Vulnerability initially disclosed
- 2026-09-10: advisory: GitHub advisory published
- 2026-09-10: patched: Patches released in v2.11.56 and v3.7.12