Traefik’s HTTP/3 server does not honor the entryPoints.<name>.transport.respondingTimeouts settings, notably readTimeout, which is enabled by default at 60 seconds. The timeout is applied only to TCP connections and cannot be enforced on a QUIC stream, so requests sent over HTTP/3 can be trickled slowly by an unauthenticated client. Each open request consumes one upstream connection and, because there is no timeout, the connection pool can become exhausted, leading to a denial of service for that HTTP/3 entry point.

Traefik versions 2.8.2 through 2.11.55 and 3.0.0 through 3.7.11 are affected. The vulnerability was introduced in 2.8.2 and fixed in 2.11.56 and 3.7.12.

The CVSS score is 6.9, indicating a moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalogue. An attacker can exploit the flaw remotely from any network that can reach an HTTP/3-enabled entry point, without needing authentication. Because the exploit simply involves sending a slow‑flood of request bytes over HTTP/3, the likelihood of exploitation is moderate, though the exact EPSS cannot be confirmed. The impact is limited to denial of service of upstream connections for the affected HTTP/3 endpoints.