Executive brief
Traefik is a reverse proxy and load balancer used to route web traffic to backend servers. In versions supporting HTTP/3, the readTimeout setting—which is enabled by default to protect against slow-upload attacks—is not applied to HTTP/3 connections. An attacker can deliberately send request data slowly to hold a connection open indefinitely, tying up backend server resources and causing service outage.
Technical details
This vulnerability is a resource exhaustion issue (CWE-770) affecting Traefik's HTTP/3 implementation. The readTimeout setting is documented as bounding the time to read an entire request including its body, enforced as a TCP connection deadline that cannot be applied to QUIC streams; Traefik's HTTP/3 server is constructed with no timeout enforcement. An unauthenticated remote client can trickling request body bytes over HTTP/3 to hold a request open indefinitely, exhausting one upstream connection per request without cost. The root cause was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that previously carried these timeouts. Fixed in v2.11.56 and v3.7.12; versions v2.8.2–v2.10.x and v3.0–v3.6 are unmaintained and have no direct patch.
Affected products
- Traefik Traefik v2.8.2 through v2.11.55, v3.0.0 through v3.7.11
Timeline
- 2026-08-27: disclosed: GHSA-7ghq-v6jf-g56c published
- 2026-09-10: patched: v2.11.56 and v3.7.12 released with fixes
- 2026-09-10: advisory: CVE-2026-88878 published