# CVE-2026-88878: Traefik HTTP/3 timeout bypass in respondingTimeouts

Source: https://junglewise.ai/threats/cve-2026-88878-traefik-http-3-timeout-bypass-in-respondingtimeouts  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88878 · Severity: medium · CVSS 5.3 · Published 2026-09-10

Traefik is a reverse proxy and load balancer used to route web traffic to backend servers. In versions supporting HTTP/3, the readTimeout setting—which is enabled by default to protect against slow-upload attacks—is not applied to HTTP/3 connections. An attacker can deliberately send request data slowly to hold a connection open indefinitely, tying up backend server resources and causing service outage.

Technologies: [Traefik](https://junglewise.ai/threats/technologies/traefik). Vendors: [Traefik](https://junglewise.ai/threats/vendors/traefik).

## Quick answers

**Is CVE-2026-88878 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88878 being exploited in the wild.

**How severe is CVE-2026-88878?** Medium severity, with a CVSS score of 5.3, published 10 September 2026.

**Which products and versions are affected?** Traefik v2.8.2 through v2.11.55, v3.0.0 through v3.7.11.

**Is there a fix for CVE-2026-88878?** A patch was published on 2026-09-10: v2.11.56 and v3.7.12 released with fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-88878 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-88878?** Check whether you run Traefik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a resource exhaustion issue (CWE-770) affecting Traefik's HTTP/3 implementation. The readTimeout setting is documented as bounding the time to read an entire request including its body, enforced as a TCP connection deadline that cannot be applied to QUIC streams; Traefik's HTTP/3 server is constructed with no timeout enforcement. An unauthenticated remote client can trickling request body bytes over HTTP/3 to hold a request open indefinitely, exhausting one upstream connection per request without cost. The root cause was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that previously carried these timeouts. Fixed in v2.11.56 and v3.7.12; versions v2.8.2–v2.10.x and v3.0–v3.6 are unmaintained and have no direct patch.

## Affected products

- Traefik Traefik v2.8.2 through v2.11.55, v3.0.0 through v3.7.11

## Timeline

- 2026-08-27: disclosed: GHSA-7ghq-v6jf-g56c published
- 2026-09-10: patched: v2.11.56 and v3.7.12 released with fixes
- 2026-09-10: advisory: CVE-2026-88878 published

## References

- [https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c](https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c)
- [https://www.vulncheck.com/advisories/traefik-2.8.2-through-3.6-http-3-timeout-bypass](https://www.vulncheck.com/advisories/traefik-2.8.2-through-3.6-http-3-timeout-bypass)

## Related threats

- [Traefik ForwardAuth connection pool identity leak via NTLM/Negotiate](https://junglewise.ai/threats/cve-2026-121966-traefik-2-x-before-2-11-60-and-3-x-before-3-7-16-sends)
- [Traefik FastProxy data race in HTTP/1 upgrades](https://junglewise.ai/threats/cve-2026-119574-traefik-from-3-2-0-before-3-7-15-contains-a-data-race-in-the)
- [Traefik authentication bypass in TLS options resolution](https://junglewise.ai/threats/cve-2026-114656-traefik-before-2-11-58-and-3-7-13-contains-an-authentication)
- [Traefik NTLM/Kerberos TLS configuration bypass](https://junglewise.ai/threats/cve-2026-114642-traefik-2-11-0-before-2-11-58-and-3-0-0-before-3-7-14-stores-its)
- [Traefik authentication bypass in backend connection pool](https://junglewise.ai/threats/cve-2026-114639-traefik-2-11-0-before-2-11-58-and-3-0-0-before-3-7-14-contains)