{"id":"CVE-2026-88012","revision":"da62d6fc6e4c4101a98d2b7252fcbbbd","records":[{"revision":"da62d6fc6e4c4101a98d2b7252fcbbbd","observedAt":"2026-10-25T16:19:22.228+00:00","statement":{"source":"nvd","id":"CVE-2026-88012","aliases":[],"title":"Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection a…","description":"Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream deadline. An unauthenticated client can use a slow request body, trickling data indefinitely while holding a request and an upstream connection open and exhausting backends with bounded connection pools. This issue is fixed in 2.11.56 and 3.7.12.","state":0,"publishedAt":"2026-09-10T16:18:08.067+00:00","modifiedAt":"2026-09-14T20:00:02.687+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/traefik/traefik/commit/a8d0bc425859dde7481a6c9a324e610b81d754d0","https://github.com/traefik/traefik/pull/13717","https://github.com/traefik/traefik/releases/tag/v2.11.56","https://github.com/traefik/traefik/releases/tag/v3.7.12","https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88012","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-770"],"productCriteria":["cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-09-10T16:18:08.067","lastModified":"2026-09-14T20:00:02.687"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-88012","identifiers":["CVE-2026-88012"]},"retained":false,"historicalAffected":[]}],"coverage":[]}