Description
Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream deadline. An unauthenticated client can use a slow request body, trickling data indefinitely while holding a request and an upstream connection open and exhausting backends with bounded connection pools. This issue is fixed in 2.11.56 and 3.7.12.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
traefik traefik
>= 2.8.2, < 2.11.56affected>= 3.0.0, < 3.7.12affected
References
- https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c ↗
- https://github.com/traefik/traefik/pull/13717 ↗
- https://github.com/traefik/traefik/commit/a8d0bc425859dde7481a6c9a324e610b81d754d0 ↗
- https://github.com/traefik/traefik/releases/tag/v2.11.56 ↗
- https://github.com/traefik/traefik/releases/tag/v3.7.12 ↗