Is CVE-2026-88878 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88878 being exploited in the wild.

How severe is CVE-2026-88878?

Medium severity, with a CVSS score of 5.3, published 10 September 2026.

Which products and versions are affected?

Traefik v2.8.2 through v2.11.55, v3.0.0 through v3.7.11.

Is there a fix for CVE-2026-88878?

A patch was published on 2026-09-10: v2.11.56 and v3.7.12 released with fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-88878 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-88878?

Check whether you run Traefik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88878: Traefik HTTP/3 timeout bypass in respondingTimeouts

CVE-2026-88878 · Severity: medium · CVSS 5.3 · Published 2026-09-10

Traefik is a reverse proxy and load balancer used to route web traffic to backend servers. In versions supporting HTTP/3, the readTimeout setting—which is enabled by default to protect against slow-upload attacks—is not applied to HTTP/3 connections. An attacker can deliberately send request data slowly to hold a connection open indefinitely, tying up backend server resources and causing service outage.

Technologies: Traefik. Vendors: Traefik.

Quick answers

Is CVE-2026-88878 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88878 being exploited in the wild.
How severe is CVE-2026-88878?: Medium severity, with a CVSS score of 5.3, published 10 September 2026.
Which products and versions are affected?: Traefik v2.8.2 through v2.11.55, v3.0.0 through v3.7.11.
Is there a fix for CVE-2026-88878?: A patch was published on 2026-09-10: v2.11.56 and v3.7.12 released with fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88878 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-88878?: Check whether you run Traefik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a resource exhaustion issue (CWE-770) affecting Traefik's HTTP/3 implementation. The readTimeout setting is documented as bounding the time to read an entire request including its body, enforced as a TCP connection deadline that cannot be applied to QUIC streams; Traefik's HTTP/3 server is constructed with no timeout enforcement. An unauthenticated remote client can trickling request body bytes over HTTP/3 to hold a request open indefinitely, exhausting one upstream connection per request without cost. The root cause was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that previously carried these timeouts. Fixed in v2.11.56 and v3.7.12; versions v2.8.2–v2.10.x and v3.0–v3.6 are unmaintained and have no direct patch.

Affected products

Traefik Traefik v2.8.2 through v2.11.55, v3.0.0 through v3.7.11

Timeline

2026-08-27: disclosed: GHSA-7ghq-v6jf-g56c published
2026-09-10: patched: v2.11.56 and v3.7.12 released with fixes
2026-09-10: advisory: CVE-2026-88878 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.