The vulnerability lies in Traefik’s handling of the readTimeout setting for HTTP/3 entrypoints. The configuration value, which limits how long a connection may wait for a complete request body, is applied to TCP connections but not to QUIC streams used by HTTP/3. An attacker can send a request body extremely slowly, causing Traefik to wait indefinitely and keeping an upstream connection open. The prolonged waiting can exhaust the bounded connection pool of the backend, leading to denial of service for legitimate traffic. The weakness is categorized as CWE‑770, indicating resource exhaustion.

This flaw affects Traefik versions 2.8.2 through 2.11.56 and 3.7.12. Users running any of these releases with an HTTP/3 entrypoint enabled are impacted. The issue is resolved in 2.11.56 and 3.7.12.

Traefik is a widely deployed reverse proxy in many containerized and cloud environments, increasing the potential impact. The CVSS score of 5.3 reflects a moderate severity, but the lack of a hard timeout for QUIC streams makes exploitation straightforward for an unauthenticated client. Because the exploit requires only unrestricted network access to the HTTP/3 port, it can be performed remotely with minimal preparation. The EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, indicating that no publicly known exploit has been reported. However, the absence of a fixed timeout still poses a significant risk for high‑traffic deployments.