Description
Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and >= v3.0.0 through <= v3.7.11, the entryPoints.<name>.transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying TCP connection, which cannot be applied to a QUIC stream, and Traefik's HTTP/3 server is constructed without any timeout. As a result, on entry points with HTTP/3 enabled, an unauthenticated remote client that trickles request body bytes can hold a request open indefinitely and, with it, one upstream connection per request, exhausting bounded backend connection pools and causing denial of service. The issue was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that carried these timeouts. Fixed in v2.11.56 and v3.7.12.
Published: 2026-09-10
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via HTTP/3 Timeout Bypass
Action: Apply Patch
AI Analysis

Impact

Traefik’s HTTP/3 server does not honor the entryPoints.<name>.transport.respondingTimeouts settings, notably readTimeout, which is enabled by default at 60 seconds. The timeout is applied only to TCP connections and cannot be enforced on a QUIC stream, so requests sent over HTTP/3 can be trickled slowly by an unauthenticated client. Each open request consumes one upstream connection and, because there is no timeout, the connection pool can become exhausted, leading to a denial of service for that HTTP/3 entry point.

Affected Systems

Traefik versions 2.8.2 through 2.11.55 and 3.0.0 through 3.7.11 are affected. The vulnerability was introduced in 2.8.2 and fixed in 2.11.56 and 3.7.12.

Risk and Exploitability

The CVSS score is 6.9, indicating a moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalogue. An attacker can exploit the flaw remotely from any network that can reach an HTTP/3-enabled entry point, without needing authentication. Because the exploit simply involves sending a slow‑flood of request bytes over HTTP/3, the likelihood of exploitation is moderate, though the exact EPSS cannot be confirmed. The impact is limited to denial of service of upstream connections for the affected HTTP/3 endpoints.

Generated by OpenCVE AI on September 10, 2026 at 14:59 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Traefik to v2.11.56 or later, or to v3.7.12 or later to receive the fixed HTTP/3 timeout handling.
  • If an upgrade is not immediately possible, disable HTTP/3 on the affected entry points or remove the problematic entry point configuration to eliminate the vulnerable path.
  • Continuously monitor upstream connection pool usage and configure additional limits or timeouts for HTTP/3 requests if available in the configuration.

Generated by OpenCVE AI on September 10, 2026 at 14:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 12 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 10 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 10 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and >= v3.0.0 through <= v3.7.11, the entryPoints.<name>.transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying TCP connection, which cannot be applied to a QUIC stream, and Traefik's HTTP/3 server is constructed without any timeout. As a result, on entry points with HTTP/3 enabled, an unauthenticated remote client that trickles request body bytes can hold a request open indefinitely and, with it, one upstream connection per request, exhausting bounded backend connection pools and causing denial of service. The issue was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that carried these timeouts. Fixed in v2.11.56 and v3.7.12.
Title Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass
First Time appeared Traefik
Traefik traefik
Weaknesses CWE-770
CPEs cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*
Vendors & Products Traefik
Traefik traefik
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Traefik Traefik
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-10T14:55:59.427Z

Reserved: 2026-09-10T11:24:26.196Z

Link: CVE-2026-88878

cve-icon Vulnrichment

Updated: 2026-09-10T14:22:23.505Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-10T14:17:16.173

Modified: 2026-09-14T19:58:08.727

Link: CVE-2026-88878

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-10T13:05:30Z

Links: CVE-2026-88878 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T14:15:18Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling