{"id":"EUVD-2026-75428","enisaUuid":"d6f6648a-9433-3ddf-bec4-c2875c8669c9","description":"Traefik is an HTTP reverse proxy and load balancer. In versions \u003e\u003d v2.8.2 through \u003c\u003d v2.11.55 and \u003e\u003d v3.0.0 through \u003c\u003d v3.7.11, the entryPoints.\u003cname\u003e.transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying TCP connection, which cannot be applied to a QUIC stream, and Traefik\u0027s HTTP/3 server is constructed without any timeout. As a result, on entry points with HTTP/3 enabled, an unauthenticated remote client that trickles request body bytes can hold a request open indefinitely and, with it, one upstream connection per request, exhausting bounded backend connection pools and causing denial of service. The issue was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that carried these timeouts. Fixed in v2.11.56 and v3.7.12.","datePublished":"Sep 10, 2026, 1:05:30 PM","dateUpdated":"Oct 8, 2026, 3:25:58 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c\nhttps://www.vulncheck.com/advisories/traefik-2.8.2-through-3.6-http-3-timeout-bypass\n","aliases":"CVE-2026-88878\nGHSA-c9gw-2969-4fg3\n","assigner":"VulnCheck","epss":0.42,"enisaIdProduct":[{"id":"194ba6dc-bd43-3d97-a104-63ebd4395207","product":{"name":"traefik","vendor":{"name":"traefik"}},"product_version":"2.8.2 ≤3.7.13"},{"id":"e98a0774-b95c-303e-a999-bd77ef5f2423","product":{"name":"traefik","vendor":{"name":"traefik"}},"product_version":"3.0.0 ≤3.7.13"}],"enisaIdVendor":[{"id":"72cf51ca-b2e1-32f0-94e4-c8d2fb32402f","vendor":{"name":"traefik"}}],"enisaIdVulnerability":[{"id":"79d522d9-3061-310f-b1ee-b67978d66a15","vulnerability":{"id":"CVE-2026-88878","description":"Traefik is an HTTP reverse proxy and load balancer. In versions \u003e\u003d v2.8.2 through \u003c\u003d v2.11.55 and \u003e\u003d v3.0.0 through \u003c\u003d v3.7.11, the entryPoints.\u003cname\u003e.transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying TCP connection, which cannot be applied to a QUIC stream, and Traefik\u0027s HTTP/3 server is constructed without any timeout. As a result, on entry points with HTTP/3 enabled, an unauthenticated remote client that trickles request body bytes can hold a request open indefinitely and, with it, one upstream connection per request, exhausting bounded backend connection pools and causing denial of service. The issue was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that carried these timeouts. Fixed in v2.11.56 and v3.7.12.","datePublished":"Sep 10, 2026, 1:05:30 PM","dateUpdated":"Oct 8, 2026, 3:25:58 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c\nhttps://www.vulncheck.com/advisories/traefik-2.8.2-through-3.6-http-3-timeout-bypass\n","enisa_id":"EUVD-2026-75428\n","assigner":"VulnCheck","epss":0.42,"dataProcessed":"Oct 30, 2026, 7:14:26 AM","vulnerabilityProduct":[{"id":"05d0af2b-4e54-36e8-aa58-6afd4e3a3eb2","product":{"name":"traefik","vendor":{"name":"traefik"}},"product_version":"3.0.0 ≤3.7.13"},{"id":"8cfed821-e461-3635-8f1e-859b79620335","product":{"name":"traefik","vendor":{"name":"traefik"}},"product_version":"2.8.2 ≤3.7.13"}],"vulnerabilityVendor":[{"id":"dba7d542-1db1-3f41-8761-740688686d1e","vendor":{"name":"traefik"}}]}},{"id":"ba73e17a-44f8-3366-9e28-2c680561c59a","vulnerability":{"id":"GHSA-c9gw-2969-4fg3","description":"Traefik is an HTTP reverse proxy and load balancer. In versions \u003e\u003d v2.8.2 through \u003c\u003d v2.11.55 and \u003e\u003d v3.0.0 through \u003c\u003d v3.7.11, the entryPoints.\u003cname\u003e.transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying TCP connection, which cannot be applied to a QUIC stream, and Traefik\u0027s HTTP/3 server is constructed without any timeout. As a result, on entry points with HTTP/3 enabled, an unauthenticated remote client that trickles request body bytes can hold a request open indefinitely and, with it, one upstream connection per request, exhausting bounded backend connection pools and causing denial of service. The issue was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that carried these timeouts. Fixed in v2.11.56 and v3.7.12.","datePublished":"Sep 10, 2026, 3:33:17 PM","dateUpdated":"Sep 10, 2026, 3:33:17 PM","baseScore":0.0,"references":"https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-88878\nhttps://www.vulncheck.com/advisories/traefik-2.8.2-through-3.6-http-3-timeout-bypass\n","enisa_id":"EUVD-2026-75428\n","aliases":"GHSA-c9gw-2969-4fg3\nCVE-2026-88878\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}