{"id":"CVE-2026-88012","revision":null,"records":[{"revision":"51c83711fc6d4f478afe03f1c92ad40d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-88012","aliases":[],"title":"Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded","description":"Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream deadline. An unauthenticated client can use a slow request body, trickling data indefinitely while holding a request and an upstream connection open and exhausting backends with bounded connection pools. This issue is fixed in 2.11.56 and 3.7.12.","state":0,"publishedAt":"2026-09-10T15:35:12.851+00:00","modifiedAt":"2026-09-11T20:33:29.626+00:00","affected":[{"ecosystem":"Vendor product","name":"traefik","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"traefik\",\n                    \"product\": \"traefik\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 2.8.2, < 2.11.56\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 3.0.0, < 3.7.12\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c","https://github.com/traefik/traefik/pull/13717","https://github.com/traefik/traefik/commit/a8d0bc425859dde7481a6c9a324e610b81d754d0","https://github.com/traefik/traefik/releases/tag/v2.11.56","https://github.com/traefik/traefik/releases/tag/v3.7.12"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-88012","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-88012","identifiers":["CVE-2026-88012"]},"retained":false,"historicalAffected":[]},{"revision":"91bc4797c2ca48a184c39c8a2595e963","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-88878","aliases":[],"title":"Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass","description":"Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and >= v3.0.0 through <= v3.7.11, the entryPoints.<name>.transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying TCP connection, which cannot be applied to a QUIC stream, and Traefik's HTTP/3 server is constructed without any timeout. As a result, on entry points with HTTP/3 enabled, an unauthenticated remote client that trickles request body bytes can hold a request open indefinitely and, with it, one upstream connection per request, exhausting bounded backend connection pools and causing denial of service. The issue was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that carried these timeouts. Fixed in v2.11.56 and v3.7.12.","state":0,"publishedAt":"2026-09-10T13:05:30.181+00:00","modifiedAt":"2026-10-08T15:25:58.415+00:00","affected":[{"ecosystem":"Vendor product","name":"traefik","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"traefik\",\n                    \"product\": \"traefik\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:golang/github.com/traefik/traefik/v2\",\n                    \"versions\": [\n                        {\n                            \"version\": \"2.8.2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThanOrEqual\": \"3.7.13\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"traefik","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"traefik\",\n                    \"product\": \"traefik\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:golang/github.com/traefik/traefik/v3\",\n                    \"versions\": [\n                        {\n                            \"version\": \"3.0.0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThanOrEqual\": \"3.7.13\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c","https://www.vulncheck.com/advisories/traefik-2.8.2-through-3.6-http-3-timeout-bypass"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-88878","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-88878","identifiers":["CVE-2026-88878"]},"retained":false,"historicalAffected":[]},{"revision":"fd02564b7e5444449ea8007fa3a35cc8","observedAt":"2026-11-09T16:08:28.844+00:00","statement":{"source":"euvd","id":"EUVD-2026-75428","aliases":["CVE-2026-88878","GHSA-c9gw-2969-4fg3"],"title":"Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and >= v3.0.0 through <= v3.7.11, the entryPoints.<name>.transport.respondingTimeouts settings — notably readTimeout, which is enabled by default …","description":"Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and >= v3.0.0 through <= v3.7.11, the entryPoints.<name>.transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying TCP connection, which cannot be applied to a QUIC stream, and Traefik's HTTP/3 server is constructed without any timeout. As a result, on entry points with HTTP/3 enabled, an unauthenticated remote client that trickles request body bytes can hold a request open indefinitely and, with it, one upstream connection per request, exhausting bounded backend connection pools and causing denial of service. The issue was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that carried these timeouts. Fixed in v2.11.56 and v3.7.12.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.9,"severity":null}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c","https://www.vulncheck.com/advisories/traefik-2.8.2-through-3.6-http-3-timeout-bypass"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-75428","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 10, 2026, 1:05:30 PM","dateUpdated":"Oct 8, 2026, 3:25:58 PM"},"relatedAdvisories":[{"id":"RHSA-2026:90321","title":"Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.31.0 Release.","vulnerabilityIds":["CVE-2023-54404","CVE-2025-62718","CVE-2026-8643","CVE-2026-9496","CVE-2026-12185","CVE-2026-13697","CVE-2026-14682","CVE-2026-15076","CVE-2026-16308","CVE-2026-17106","CVE-2026-18427","CVE-2026-19203","CVE-2026-19534","CVE-2026-39820","CVE-2026-41178","CVE-2026-41707","CVE-2026-42499","CVE-2026-42502","CVE-2026-45416","CVE-2026-47884","CVE-2026-47886","CVE-2026-47888","CVE-2026-47890","CVE-2026-47892","CVE-2026-50010","CVE-2026-55831","CVE-2026-55833","CVE-2026-55851","CVE-2026-56745","CVE-2026-56746","CVE-2026-56819","CVE-2026-56852","CVE-2026-56854","CVE-2026-58062","CVE-2026-59280","CVE-2026-59282","CVE-2026-59283","CVE-2026-59296","CVE-2026-59313","CVE-2026-59323","CVE-2026-59651","CVE-2026-59887","CVE-2026-59899","CVE-2026-59901","CVE-2026-62243","CVE-2026-64607","CVE-2026-67213","CVE-2026-67312","CVE-2026-67313","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321","CVE-2026-68494","CVE-2026-68497","CVE-2026-69152","CVE-2026-69192","CVE-2026-71290","CVE-2026-71324","CVE-2026-71325","CVE-2026-71327","CVE-2026-73500","CVE-2026-73508","CVE-2026-74835","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-76169","CVE-2026-81521","CVE-2026-82417","CVE-2026-82562","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84428","CVE-2026-84445","CVE-2026-84469","CVE-2026-84504","CVE-2026-84961","CVE-2026-85062","CVE-2026-85124","CVE-2026-85152","CVE-2026-85595","CVE-2026-85597","CVE-2026-86063","CVE-2026-87743","CVE-2026-88004","CVE-2026-88007","CVE-2026-88008","CVE-2026-88009","CVE-2026-88011","CVE-2026-88012","CVE-2026-88031","CVE-2026-88878","CVE-2026-88879","CVE-2026-90711","CVE-2026-93749","CVE-2026-100655","CVE-2026-100656","CVE-2026-100666","CVE-2026-101916","CVE-2026-102925","CVE-2026-102930","CVE-2026-103435","CVE-2026-109618","CVE-2026-109619"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-75428","identifiers":["EUVD-2026-75428","CVE-2026-88878","GHSA-c9gw-2969-4fg3"]},"retained":false,"historicalAffected":[]},{"revision":"673dc684484047698e7b1de9b8e3d551","observedAt":"2026-11-09T16:08:04.394+00:00","statement":{"source":"euvd","id":"EUVD-2026-75562","aliases":["CVE-2026-88012","GHSA-7ghq-v6jf-g56c"],"title":"Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection a…","description":"Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream deadline. An unauthenticated client can use a slow request body, trickling data indefinitely while holding a request and an upstream connection open and exhausting backends with bounded connection pools. This issue is fixed in 2.11.56 and 3.7.12.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":null}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c","https://github.com/traefik/traefik/pull/13717","https://github.com/traefik/traefik/commit/a8d0bc425859dde7481a6c9a324e610b81d754d0","https://github.com/traefik/traefik/releases/tag/v2.11.56","https://github.com/traefik/traefik/releases/tag/v3.7.12"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-75562","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 10, 2026, 3:35:12 PM","dateUpdated":"Sep 11, 2026, 8:33:29 PM"},"relatedAdvisories":[{"id":"RHSA-2026:90321","title":"Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.31.0 Release.","vulnerabilityIds":["CVE-2023-54404","CVE-2025-62718","CVE-2026-8643","CVE-2026-9496","CVE-2026-12185","CVE-2026-13697","CVE-2026-14682","CVE-2026-15076","CVE-2026-16308","CVE-2026-17106","CVE-2026-18427","CVE-2026-19203","CVE-2026-19534","CVE-2026-39820","CVE-2026-41178","CVE-2026-41707","CVE-2026-42499","CVE-2026-42502","CVE-2026-45416","CVE-2026-47884","CVE-2026-47886","CVE-2026-47888","CVE-2026-47890","CVE-2026-47892","CVE-2026-50010","CVE-2026-55831","CVE-2026-55833","CVE-2026-55851","CVE-2026-56745","CVE-2026-56746","CVE-2026-56819","CVE-2026-56852","CVE-2026-56854","CVE-2026-58062","CVE-2026-59280","CVE-2026-59282","CVE-2026-59283","CVE-2026-59296","CVE-2026-59313","CVE-2026-59323","CVE-2026-59651","CVE-2026-59887","CVE-2026-59899","CVE-2026-59901","CVE-2026-62243","CVE-2026-64607","CVE-2026-67213","CVE-2026-67312","CVE-2026-67313","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321","CVE-2026-68494","CVE-2026-68497","CVE-2026-69152","CVE-2026-69192","CVE-2026-71290","CVE-2026-71324","CVE-2026-71325","CVE-2026-71327","CVE-2026-73500","CVE-2026-73508","CVE-2026-74835","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-76169","CVE-2026-81521","CVE-2026-82417","CVE-2026-82562","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84428","CVE-2026-84445","CVE-2026-84469","CVE-2026-84504","CVE-2026-84961","CVE-2026-85062","CVE-2026-85124","CVE-2026-85152","CVE-2026-85595","CVE-2026-85597","CVE-2026-86063","CVE-2026-87743","CVE-2026-88004","CVE-2026-88007","CVE-2026-88008","CVE-2026-88009","CVE-2026-88011","CVE-2026-88012","CVE-2026-88031","CVE-2026-88878","CVE-2026-88879","CVE-2026-90711","CVE-2026-93749","CVE-2026-100655","CVE-2026-100656","CVE-2026-100666","CVE-2026-101916","CVE-2026-102925","CVE-2026-102930","CVE-2026-103435","CVE-2026-109618","CVE-2026-109619"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-75562","identifiers":["EUVD-2026-75562","CVE-2026-88012","GHSA-7ghq-v6jf-g56c"]},"retained":false,"historicalAffected":[]},{"revision":"da62d6fc6e4c4101a98d2b7252fcbbbd","observedAt":"2026-10-25T16:19:22.228+00:00","statement":{"source":"nvd","id":"CVE-2026-88012","aliases":[],"title":"Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection a…","description":"Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream deadline. An unauthenticated client can use a slow request body, trickling data indefinitely while holding a request and an upstream connection open and exhausting backends with bounded connection pools. This issue is fixed in 2.11.56 and 3.7.12.","state":0,"publishedAt":"2026-09-10T16:18:08.067+00:00","modifiedAt":"2026-09-14T20:00:02.687+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/traefik/traefik/commit/a8d0bc425859dde7481a6c9a324e610b81d754d0","https://github.com/traefik/traefik/pull/13717","https://github.com/traefik/traefik/releases/tag/v2.11.56","https://github.com/traefik/traefik/releases/tag/v3.7.12","https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88012","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-770"],"productCriteria":["cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-09-10T16:18:08.067","lastModified":"2026-09-14T20:00:02.687"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-88012","identifiers":["CVE-2026-88012"]},"retained":false,"historicalAffected":[]},{"revision":"a3a788a848cc4256bee5a757ced3b1a0","observedAt":"2026-10-25T16:19:22.228+00:00","statement":{"source":"nvd","id":"CVE-2026-88878","aliases":[],"title":"Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and >= v3.0.0 through <= v3.7.11, the entryPoints.<name>.transport.respondingTimeouts settings — notably readTimeout, which is enabled by default …","description":"Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and >= v3.0.0 through <= v3.7.11, the entryPoints.<name>.transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying TCP connection, which cannot be applied to a QUIC stream, and Traefik's HTTP/3 server is constructed without any timeout. As a result, on entry points with HTTP/3 enabled, an unauthenticated remote client that trickles request body bytes can hold a request open indefinitely and, with it, one upstream connection per request, exhausting bounded backend connection pools and causing denial of service. The issue was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that carried these timeouts. Fixed in v2.11.56 and v3.7.12.","state":0,"publishedAt":"2026-09-10T14:17:16.173+00:00","modifiedAt":"2026-10-08T16:17:58.807+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c","https://www.vulncheck.com/advisories/traefik-2.8.2-through-3.6-http-3-timeout-bypass"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88878","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-770"],"productCriteria":["cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-09-10T14:17:16.173","lastModified":"2026-10-08T16:17:58.807"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-88878","identifiers":["CVE-2026-88878"]},"retained":false,"historicalAffected":[]},{"revision":"106c97593536402fb466dccf421f8ad7","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-7ghq-v6jf-g56c","aliases":["CVE-2026-88012","CVE-2026-88878","GO-2026-6454"],"title":"Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded","description":"## Summary\n\nThere is a medium severity vulnerability in Traefik's HTTP/3 entry points: the `respondingTimeouts` settings were not applied to the HTTP/3 request path. `readTimeout` in particular is on by default at 60s and is documented as bounding the time to read the entire request including its body, but it is enforced as a deadline on the TCP connection, which cannot reach a QUIC stream, and Traefik's HTTP/3 server was constructed with no timeout of any kind. An unauthenticated client that trickles a request body therefore holds a request open for as long as it chooses, and with it one upstream connection per request, at negligible cost to itself. Backends with bounded connection pools are the practical pressure point.\n\nThe HTTP/3 path lost these timeouts in v2.8.2, when a quic-go API change removed the embedded `http.Server` that had carried them; every release from v2.8.2 onward is affected, and releases before v2.8.2 are not. Traefik v2.8.2 through v2.10.x and v3.0 through v3.6 are affected and are no longer maintained: they will not receive a patch on their own line, and the remedy for their users is to upgrade to v2.11.56 or v3.7.12.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.56\n- https://github.com/traefik/traefik/releases/tag/v3.7.12\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n<details>\n<summary>Original Description</summary>\n\n## Summary\n\n`entryPoints.<name>.transport.respondingTimeouts.readTimeout` is documented as:\n\n> \"Set the timeouts for incoming requests to the Traefik instance. This is the maximum\n> duration for reading the entire request, **including the body**.\" — **Default: 60s**\n\nIt is **on by default** and it works over HTTP/1.1 and HTTP/2. It has **no effect on\nHTTP/3**.\n\nThe consequence is not that a hardening option was left unset. It is that every Traefik\ndeployment with `http3` enabled carries a 60-second bound that the operator has every\nreason to believe is in force, and which is silently absent on that protocol. A single\nclient trickling one body byte every few seconds holds a request open indefinitely, and\nwith it one upstream connection per request.\n\n`readTimeout` is applied as a deadline on the **TCP connection**. HTTP/3 does not have\none, and Traefik's HTTP/3 server is constructed with no timeout of any kind.\n\n## Steps to reproduce\n\nNo containers, VMs or cloud services — the official release binary, `curl`, `openssl`,\nand a 68-line Python standard-library backend. Everything is attached.\n\n```sh\nbash reproduce.sh                 # readTimeout 5s, ~40 seconds\nMODE=default bash reproduce.sh    # the stock 60s default, ~4 minutes\n```\n\nBy hand:\n\n**1. Static config** (`conf/traefik.yml`, complete and unredacted). Note there is no\n`respondingTimeouts` block at all — this is the documented 60s default:\n\n```yaml\nglobal:\n  checkNewVersion: false\n  sendAnonymousUsage: false\n\nlog:\n  level: DEBUG\n\nentryPoints:\n  websecure:\n    address: \":8443\"\n    http3:\n      advertisedPort: 8443\n\nproviders:\n  file:\n    filename: conf/dynamic.yml\n\napi:\n  dashboard: false\n```\n\n**2. Dynamic config** (`conf/dynamic.yml`):\n\n```yaml\nhttp:\n  routers:\n    backend-router:\n      rule: \"PathPrefix(`/`)\"\n      service: backend-svc\n      entryPoints: [websecure]\n      tls: {}\n  services:\n    backend-svc:\n      loadBalancer:\n        servers:\n          - url: \"http://127.0.0.1:8080\"\ntls:\n  certificates:\n    - certFile: cert.pem\n      keyFile: key.pem\n```\n\n**3. A self-signed cert**, so no CA install and no sudo:\n\n```sh\nopenssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 30 -nodes \\\n    -subj \"/CN=localhost\" -addext \"subjectAltName=DNS:localhost,IP:127.0.0.1\"\n```\n\n**4. A backend that reads the request body** before responding, as a real HTTP/1.1 server\ndoes (`backend.py`, standard library only). This matters: a backend that answers the\nrequest headers alone lets Traefik release the upstream connection immediately, which\nhides the behaviour entirely.\n\n```sh\npython3 backend.py 8080 &\n./traefik --configFile=conf/traefik.yml\n```\n\n**5. The same slow upload over each protocol.** The hold must exceed the timeout under\ntest, so 92 seconds against the 60-second default:\n\n```sh\n{ for i in $(seq 1 23); do printf 'x'; sleep 4; done; } | \\\n    curl -v -k -T - --http1.1     https://localhost:8443/\n\n{ for i in $(seq 1 23); do printf 'x'; sleep 4; done; } | \\\n    curl -v -k -T - --http3-only  https://localhost:8443/\n```\n\n## Result\n\nTraefik **v3.7.10** (`langres`, go1.26.5), official\n`traefik_v3.7.10_linux_amd64.tar.gz`, sha256\n`01811bb12d44f17280550f425f5e3128d6c325f2665c09e67a651ca535f490ce`.\n\nUpstream connection lifetime measured at the backend — the client's view only shows the\n*absence* of a server action, which proves nothing on its own:\n\n| config | hold | HTTP/1.1 (control) | HTTP/3 |\n|---|---|---|---|\n| **stock — documented 60s default** | 92 s | **59.99 s** — released at the documented default | **92.94 s** — held for the entire window |\n| `readTimeout: 5s` | 30 s | **4.99 s** | **30.98 s** |\n\nThe HTTP/1.1 column is the control and it is the point of the exercise: the timeout is\ndemonstrably live on this exact binary, releasing the upstream at its configured value.\nThe HTTP/3 request, in the same run against the same instance with the same setting, ran\nto completion with the upstream pinned throughout. Traefik returned `499` on the aborted\nHTTP/1.1 arm and took no action at all on HTTP/3 — no `RST_STREAM`, no\n`H3_REQUEST_INCOMPLETE`, no connection close.\n\nThe setting is not being silently discarded: Traefik's own DEBUG log prints the loaded\nstatic configuration including `\"respondingTimeouts\":{\"idleTimeout\":\"3m0s\",\"readTimeout\":\"5s\"}`.\nFull `curl -v` output, backend logs and Traefik DEBUG logs for every arm are in\n`evidence/`.\n\n## Cause\n\n**`readTimeout` is a TCP connection deadline** —\n`pkg/server/server_entrypoint_tcp.go:273`:\n\n```go\nif e.transportConfiguration.RespondingTimeouts.ReadTimeout > 0 {\n    err := writeCloser.SetReadDeadline(time.Now().Add(time.Duration(e.transportConfiguration.RespondingTimeouts.ReadTimeout)))\n```\n\nA deadline on a TCP connection cannot reach a QUIC stream.\n\n**And the HTTP/3 server is given no timeout of any kind** —\n`pkg/server/server_entrypoint_tcp_http3.go:65`:\n\n```go\nh3.Server = &http3.Server{\n    Addr:      config.GetAddress(),\n    Port:      config.HTTP3.AdvertisedPort,\n    Handler:   httpsServer.Server.(*http.Server).Handler,\n    TLSConfig: &tls.Config{GetConfigForClient: h3.getTLSConfigForClient},\n    QUICConfig: &quic.Config{\n        Allow0RTT: false,\n    },\n    ConnContext: func(ctx context.Context, c *quic.Conn) context.Context {\n```\n\nIt reuses the HTTPS server's **handler** and inherits none of its timeouts. There is\ntherefore no duration control on the HTTP/3 request path at all — not `readTimeout`, not\n`idleTimeout`, nothing.\n\nNote that this cannot be fixed by passing a field through: quic-go's `http3.Server`\nexposes no request-read deadline. The remedy has to be enforced around the request body\ninside the handler, or upstream in quic-go.\n\n## Suggested remedy\n\nIn preference order:\n\n1. **Enforce `readTimeout` on the HTTP/3 path in the handler.** Traefik already passes the\n   HTTPS server's handler to `http3.Server`, so when `RespondingTimeouts.ReadTimeout > 0`\n   it can wrap `r.Body` for HTTP/3 requests in a reader that enforces the deadline.\n2. Add a request-read deadline upstream in quic-go's `http3.Server` and pass it through.\n3. **At minimum, document it.** See below — the current documentation does not tell an\n   operator this.\n\n### A sketch of option 1\n\nOffered as a description of the shape, **not as a patch**. I have not built or tested this\nagainst Traefik, and I am not going to present untested code as though I had. If a working,\ntested patch would be useful, say so and I will prepare one properly and verify it against\nthe reproducer above.\n\nWhere the HTTP/3 handler is wired up — `server_entrypoint_tcp_http3.go`, around the\n`http3.Server` construction — the handler passed in could be wrapped so that, when\n`ReadTimeout` is configured, an HTTP/3 request body carries the same deadline the TCP path\ngets from `SetReadDeadline`:\n\n```go\n// Roughly: for HTTP/3 requests only, and only when the timeout is set.\nif readTimeout > 0 && r.ProtoMajor == 3 && r.Body != nil {\n    r.Body = deadlineBody(r.Body, readTimeout)\n}\n```\n\nThe part worth knowing, because it is what makes the approach work rather than merely\nlook tidy: **closing the request body cancels the QUIC stream read.** In quic-go,\n`http3`'s body `Close()` calls `str.CancelRead(...)`, which unblocks a `Read` that is\nalready parked waiting on the client. So a timer that closes the body on expiry bounds\nboth a client that trickles *and* a client that simply stops sending — the latter being\nthe case a wrapper that only checks the clock on each returning `Read` would miss\nentirely.\n\nReturning `os.ErrDeadlineExceeded` from the wrapped `Read` keeps the failure classified as\na timeout rather than a client abort, which matters for whatever status code and logging\nyou decide is right.\n\nTwo design questions I would not want to answer on your behalf: whether HTTP/3 should reuse\n`respondingTimeouts.readTimeout` or get its own setting, and whether enforcement belongs in\nthe handler wrapper or somewhere closer to the entrypoint. Both are your call.\n\n## A documentation issue, separately\n\nTwo things in the docs are worth correcting regardless of how the code question is\nresolved.\n\n**1. The `readTimeout` description carries no protocol qualification.** It says \"the\nmaximum duration for reading the entire request, including the body\", which is exactly\nwhat an operator relies on. The entrypoint page does note that respondingTimeouts have\n\"no effect for UDP entryPoints\", but that does not cover this case: HTTP/3 here is served\non an **HTTP** entrypoint with an `http3:` block, not on a Traefik **UDP entrypoint**,\nwhich is a separate feature for UDP routers. An operator who adds `http3:` to their\nexisting HTTPS entrypoint has not created a UDP entrypoint and has no reason to read that\ncaveat as applying to them.\n\n**2. `SECURITY.md`'s supported-versions table is stale.** It lists `3.6.x` as supported\nand `< 3.6.x` as unsupported, while 3.7.10 is the current release. Anyone checking whether\ntheir version is in scope before reporting gets a confusing answer.\n\n## Impact\n\nEach held request occupies one upstream connection for as long as the client chooses, at\nnegligible cost to the client, and the same client can open many. Backends with bounded\nconnection pools are the practical pressure point.\n\nI have **not** measured a concurrency ceiling on Traefik itself, so I am not asserting\none. If that number matters to your assessment, tell me and I will measure it.\n\n## LLM (\"AI\") use disclosure\n\nNot required by your policy, but stated because it is true and you should be able to\nweigh it. I am a penetration tester, not a Go developer. The finding, the attack concept\nand the decision to measure the upstream leg rather than the client are mine. An LLM\ncoding assistant (Claude) built the test harness, ran the matrix, and located the two\nsource citations; I verified those by hand against the `v3.7.10` tag and ran the\nreproducer myself. I am a human and I will be the one replying in this thread.\n\n## Disclosure\n\nBishop Fox operates a 90-day disclosure policy, starting the day this is submitted, with\nextensions where a fix is in progress. Tell me what you would prefer and I will work to\nit.\n\n## Environment\n\n- Traefik v3.7.10, official `traefik_v3.7.10_linux_amd64.tar.gz`,\n  sha256 `01811bb12d44f17280550f425f5e3128d6c325f2665c09e67a651ca535f490ce`\n- Kali GNU/Linux (WSL2), kernel 6.6.114.1\n- curl 8.19.0 with ngtcp2 1.21.0 / nghttp3 1.15.0### Summary\n_Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server._\n\n### Details\n_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._\n\n### PoC\n_Complete instructions, including specific configuration details, to reproduce the vulnerability._\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\n\n</details>\n---","state":0,"publishedAt":"2026-09-10T20:27:16+00:00","modifiedAt":"2026-09-17T17:40:37.4238642+00:00","affected":[{"ecosystem":"Go","name":"github.com/traefik/traefik/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.8.2"},{"kind":"fixed","version":"2.11.56"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/traefik/traefik/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.7.12"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c","https://nvd.nist.gov/vuln/detail/CVE-2026-88012","https://github.com/traefik/traefik/pull/13717","https://github.com/traefik/traefik/commit/a8d0bc425859dde7481a6c9a324e610b81d754d0","https://github.com/traefik/traefik","https://github.com/traefik/traefik/releases/tag/v2.11.56","https://github.com/traefik/traefik/releases/tag/v3.7.12"],"sourceUrl":"https://github.com/advisories/GHSA-7ghq-v6jf-g56c","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-7ghq-v6jf-g56c","identifiers":["GHSA-7ghq-v6jf-g56c","CVE-2026-88012","CVE-2026-88878","GO-2026-6454"]},"retained":false,"historicalAffected":[]},{"revision":"7a7dd8ac9de64bfa90a83ee57581863b","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6454","aliases":["CVE-2026-88012","CVE-2026-88878","GHSA-7ghq-v6jf-g56c"],"title":"Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded in github.com/traefik/traefik","description":"Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded in github.com/traefik/traefik","state":0,"publishedAt":"2026-09-16T16:56:22+00:00","modifiedAt":"2026-09-17T17:40:37.4238642+00:00","affected":[{"ecosystem":"Go","name":"github.com/traefik/traefik","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/traefik/traefik/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.8.2"},{"kind":"fixed","version":"2.11.56"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/traefik/traefik/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.7.12"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c","https://nvd.nist.gov/vuln/detail/CVE-2026-88012","https://github.com/traefik/traefik/commit/a8d0bc425859dde7481a6c9a324e610b81d754d0","https://github.com/traefik/traefik/pull/13717","https://github.com/traefik/traefik/releases/tag/v2.11.56","https://github.com/traefik/traefik/releases/tag/v3.7.12"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6454","license":"OSV · upstream source license applies","key":"osv:GO-2026-6454","identifiers":["GO-2026-6454","CVE-2026-88012","CVE-2026-88878","GHSA-7ghq-v6jf-g56c"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T18:23:45.7727801+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T18:23:45.7727801+00:00","lastSuccessAt":"2026-11-10T18:23:45.9579119+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.9579152+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-d220ab899e0e1c49e43094274f562c18c4a19b03898aec3feae1debdd31f6756","complete":true,"records":422212,"lastAttemptAt":"2026-11-10T18:21:27.6685178+00:00","lastSuccessAt":"2026-11-10T18:21:27.4920545+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:21:27.6685178+00:00","snapshotPublishedAt":"2026-11-10T17:27:33+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-acbb624a79c244aa868394151a25f053","complete":true,"records":13704,"lastAttemptAt":"2026-11-10T18:24:12.0072206+00:00","lastSuccessAt":"2026-11-10T18:24:12.001+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:24:12.001+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13758,"expectedIdentifiers":13758,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T18:23:45.7727801+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T18:23:45.7727801+00:00","lastSuccessAt":"2026-11-10T18:23:45.9591411+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.9591459+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-4459456b8f8c43778c308d7de0a43211","complete":true,"records":13710,"lastAttemptAt":"2026-11-10T18:24:11.1447617+00:00","lastSuccessAt":"2026-11-10T18:24:11.141+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:24:11.141+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13758,"expectedIdentifiers":13758,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-50a085e5b7a5d1546eabdb7e52fab85d658afa8554d3cf95a0891c49d83f2979","complete":true,"records":9935,"lastAttemptAt":"2026-11-10T18:23:45.7142755+00:00","lastSuccessAt":"2026-11-10T16:25:20.0114252+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.7142755+00:00","snapshotPublishedAt":"2026-11-10T16:18:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T18:21:27.7170016+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:21:27.7170016+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-df497239f2f75af38e095cb498791dad4044a8a9a7f5f0ee6008bb732579ab9d","complete":true,"records":3081,"lastAttemptAt":"2026-11-10T18:23:45.7340645+00:00","lastSuccessAt":"2026-11-10T14:21:34.3717399+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.7340645+00:00","snapshotPublishedAt":"2026-11-10T14:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-5bab1d7e68ac802e78d67f5b951f7bcace0c45048e98b39b73b18376172e4b36","complete":true,"records":231619,"lastAttemptAt":"2026-11-10T18:23:45.5819776+00:00","lastSuccessAt":"2026-11-10T18:23:44.1117746+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.5819776+00:00","snapshotPublishedAt":"2026-11-10T17:33:21+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}