CyberRota Analysis
AI-GeneratedTraefik versions 2.8.2 through 2.11.56 and 3.7.12 are vulnerable due to a failure to enforce read timeouts on HTTP/3 entrypoints, allowing unauthenticated clients to exploit this by sending slow request bodies and potentially exhausting backend connection pools. This could lead to service degradation or denial of service for legitimate users. Organizations using affected versions of Traefik should prioritize upgrading to the fixed versions to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream deadline. An unauthenticated client can use a slow request body, trickling data indefinitely while holding a request and an upstream connection open and exhausting backends with bounded connection pools. This issue is fixed in 2.11.56 and 3.7.12.