{"items":[{"id":"NVI-00015378","kind":"vulnerability","title":"Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-7ghq-v6jf-g56c","CVE-2026-88012"],"plain_summary":"GitHub lists this reviewed advisory for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-6262983473d9147364aa3223626dd207"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-10T20:27:17.000Z","value":"5.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-6262983473d9147364aa3223626dd207"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-6262983473d9147364aa3223626dd207","url":"https://github.com/advisories/GHSA-7ghq-v6jf-g56c","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-7ghq-v6jf-g56c","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T22:54:05.264Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-6262983473d9147364aa3223626dd207"],"technology":"github.com/traefik/traefik/v2","known_exclusions":[],"conditions_summary":"## Summary\n\nThere is a medium severity vulnerability in Traefik's HTTP/3 entry points: the `respondingTimeouts` settings were not applied to the HTTP/3 request path. `readTimeout` in particular is on by default at 60s and is documented as bounding the time to read the entire request including its body, but it is enforced as a deadline on the TCP connection, which cannot reach a QUIC stream, and Traefik's HTTP/3 server was constructed with no timeout of any kind. An unauthenticated client that trickles a request body therefore holds a request open for as long as it chooses, and with it one upstream connection per request, at negligible cost to itself. Backends with bounded connection pools are the practical pressure point.\n\nThe HTTP/3 path lost these timeouts in v2.8.2, when a quic-go API change removed the embedded `http.Server` that had carried them; every release from v2.8.2 onward is affected, and releases before v2.8.2 are not. Traefik v2.8.2 through v2.10.x and v3.0 through v3.6 are affected and are no longer maintained: they will not receive a patch on their own line, and the remedy for their users is to upgrade to v2.11.56 or v3.7.12.\n\n## Patches\n\n- https://github.com/traefi","public_affected_ranges":[">= 2.8.2, < 2.11.56"]},{"certainty":"source_listed","source_ids":["sr-6262983473d9147364aa3223626dd207"],"technology":"github.com/traefik/traefik/v3","known_exclusions":[],"conditions_summary":"## Summary\n\nThere is a medium severity vulnerability in Traefik's HTTP/3 entry points: the `respondingTimeouts` settings were not applied to the HTTP/3 request path. `readTimeout` in particular is on by default at 60s and is documented as bounding the time to read the entire request including its body, but it is enforced as a deadline on the TCP connection, which cannot reach a QUIC stream, and Traefik's HTTP/3 server was constructed with no timeout of any kind. An unauthenticated client that trickles a request body therefore holds a request open for as long as it chooses, and with it one upstream connection per request, at negligible cost to itself. Backends with bounded connection pools are the practical pressure point.\n\nThe HTTP/3 path lost these timeouts in v2.8.2, when a quic-go API change removed the embedded `http.Server` that had carried them; every release from v2.8.2 onward is affected, and releases before v2.8.2 are not. Traefik v2.8.2 through v2.10.x and v3.0 through v3.6 are affected and are no longer maintained: they will not receive a patch on their own line, and the remedy for their users is to upgrade to v2.11.56 or v3.7.12.\n\n## Patches\n\n- https://github.com/traefi","public_affected_ranges":[">= 3.0.0, < 3.7.12"]}],"null_published_at":"2026-11-03T10:03:31.359Z","source_updated_at":"2026-09-10T20:27:17.000Z","source_disclosed_at":"2026-09-10T20:27:16.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T22:54:05.264Z"}],"next_cursor":null,"snapshot_revision":"42594"}