Is CVE-2026-88012 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88012 being exploited in the wild.

How severe is CVE-2026-88012?

Medium severity, with a CVSS score of 5.3, published 10 September 2026.

Which products and versions are affected?

github.com/traefik/traefik (Go) SEMVER:introduced=0; github.com/traefik/traefik/v2 (Go) >= 2.8.2, = 3.0.0, < 3.7.12, SEMVER:introduced=3.0.0,fixed=3.7.12.

Is there a fix for CVE-2026-88012?

Yes. github.com/traefik/traefik/v2 (Go): upgrade to 2.11.56 or later; github.com/traefik/traefik/v3 (Go): upgrade to 3.7.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-88012 attacked?

It is attacked over the network.

Am I affected by CVE-2026-88012?

Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go) or github.com/traefik/traefik/v3 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88012: Traefik readTimeout not enforced on HTTP/3 connections

Q: Is there a fix for CVE-2026-88012?

Yes. github.com/traefik/traefik/v2 (Go): upgrade to 2.11.56 or later; github.com/traefik/traefik/v3 (Go): upgrade to 3.7.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-88012 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-88012?

Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go) or github.com/traefik/traefik/v3 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88012 · Severity: medium · CVSS 5.3 · Published 2026-09-10

Traefik is a reverse proxy and load balancer used to route incoming traffic to backend services. The HTTP/3 protocol support in Traefik does not enforce the configured request read timeout, allowing clients to hold connections open indefinitely by trickling data slowly. This permits a small number of unauthenticated clients to exhaust backend connection pools and cause denial of service.

Technologies: github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go). Vendors: Go.

Quick answers

Is CVE-2026-88012 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88012 being exploited in the wild.
How severe is CVE-2026-88012?: Medium severity, with a CVSS score of 5.3, published 10 September 2026.
Which products and versions are affected?: github.com/traefik/traefik (Go) SEMVER:introduced=0; github.com/traefik/traefik/v2 (Go) >= 2.8.2, < 2.11.56, SEMVER:introduced=2.8.2,fixed=2.11.56; github.com/traefik/traefik/v3 (Go) >= 3.0.0, < 3.7.12, SEMVER:introduced=3.0.0,fixed=3.7.12.
Is there a fix for CVE-2026-88012?: Yes. github.com/traefik/traefik/v2 (Go): upgrade to 2.11.56 or later; github.com/traefik/traefik/v3 (Go): upgrade to 3.7.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88012 attacked?: It is attacked over the network.
Am I affected by CVE-2026-88012?: Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go) or github.com/traefik/traefik/v3 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/traefik/traefik/v2 (Go): upgrade to 2.11.56 or later
```
go get github.com/traefik/traefik/v2@v2.11.56
```
github.com/traefik/traefik/v3 (Go): upgrade to 3.7.12 or later
```
go get github.com/traefik/traefik/v3@v3.7.12
```

Technical details

The `respondingTimeouts.readTimeout` configuration parameter in Traefik is documented to limit the time to read an entire HTTP request including its body, with a default of 60 seconds. This timeout is enforced on HTTP/1.1 and HTTP/2 connections via a TCP-level read deadline, but it does not apply to HTTP/3 (QUIC) connections because QUIC is stream-based rather than TCP-based, and Traefik's HTTP/3 server implementation (`http3.Server`) is constructed without any timeout configuration. An unauthenticated attacker can send HTTP/3 requests with very slow body uploads (e.g., one byte every few seconds), holding each upstream connection for as long as desired with minimal client resource overhead. Affected versions are Traefik v2.8.2–v2.10.x and v3.0–v3.6. The vulnerability was introduced in v2.8.2 due to a quic-go API change that removed the embedded `http.Server` which previously carried timeouts. Patches are available in v2.11.56 and v3.7.12.

Affected products

Traefik Traefik 2.8.2 to 2.10.x, 3.0 to 3.6

Identifiers

CVE-2026-88012
GHSA-7ghq-v6jf-g56c
GO-2026-6454

Timeline

2026-08-27: disclosed: Vulnerability initially disclosed
2026-09-10: advisory: GitHub advisory published
2026-09-10: patched: Patches released in v2.11.56 and v3.7.12

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.