CVE-2026-88012 in Traefik
Summary
by MITRE • 09/10/2026
Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream deadline. An unauthenticated client can use a slow request body, trickling data indefinitely while holding a request and an upstream connection open and exhausting backends with bounded connection pools. This issue is fixed in 2.11.56 and 3.7.12.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
Traefik serves as a widely adopted open-source HTTP reverse proxy and load balancer, facilitating traffic routing across distributed systems. A critical configuration oversight exists within the handling of HTTP/3 entrypoints in versions ranging from 2.8.2 through 2.11.56 and version 3.7.12. The core technical flaw lies in the failure to apply the configured transport responding timeouts, specifically readTimeout, to HTTP/3 connections. In standard TCP-based HTTP implementations, these timeouts are enforced at the connection level, ensuring that if a client fails to send data within a specified period, the server closes the connection to free up resources. However, for HTTP/3 which operates over QUIC, this enforcement mechanism is absent because there is no corresponding deadline applied to individual QUIC streams. This architectural gap means that while TCP connections are subject to strict timeout policies, QUIC-based requests remain open indefinitely unless explicitly managed by higher-level application logic or external load balancers.
The operational impact of this vulnerability is significant for system availability and resource management. An unauthenticated attacker can exploit this lack of stream deadlines by initiating a slow request body attack, also known as a Slowloris-style attack but adapted for HTTP/3. By trickling data at an extremely low rate, the client keeps the QUIC stream open while holding both the incoming connection to Traefik and the upstream outbound connection to backend services active. Since many backends utilize bounded connection pools to manage concurrency and prevent resource exhaustion, this behavior allows a single malicious actor to consume multiple backend connections simultaneously. Over time, this leads to the depletion of available connections in the pool, effectively causing a denial of service for legitimate users who are unable to establish new sessions or receive responses from the affected services.
This vulnerability aligns with CWE-400, which describes uncontrolled resource consumption, as well as CWE-756: Missing Expirable Control Mechanism, due to the absence of an automatic timeout mechanism for QUIC streams. From a threat intelligence perspective, this behavior is consistent with ATT&CK technique T1499: Endpoint Denial of Service, specifically under sub-techniques involving resource exhaustion via slow or low-rate attacks. The lack of enforcement at the protocol level allows attackers to bypass standard network-level protections that rely on TCP state tracking and timeout counters.
To mitigate this risk, organizations running affected versions must upgrade immediately to Traefik version 2.11.56 or 3.7.12, where the developers have implemented proper handling of stream deadlines for HTTP/3 connections. Until an upgrade is feasible, administrators should consider deploying a front-end security appliance or Web Application Firewall that can enforce connection timeouts and rate limiting at the network layer before traffic reaches Traefik. Additionally, configuring upstream services to implement their own aggressive timeout policies on incoming requests can provide a secondary layer of defense against slow request body attacks. Monitoring for unusually long-lived connections with minimal data throughput can also aid in early detection of such exploitation attempts.