{"id":"EUVD-2026-75562","enisaUuid":"c015f937-53b6-3781-a55d-540060f21429","description":"Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream deadline. An unauthenticated client can use a slow request body, trickling data indefinitely while holding a request and an upstream connection open and exhausting backends with bounded connection pools. This issue is fixed in 2.11.56 and 3.7.12.","datePublished":"Sep 10, 2026, 3:35:12 PM","dateUpdated":"Sep 11, 2026, 8:33:29 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c\nhttps://github.com/traefik/traefik/pull/13717\nhttps://github.com/traefik/traefik/commit/a8d0bc425859dde7481a6c9a324e610b81d754d0\nhttps://github.com/traefik/traefik/releases/tag/v2.11.56\nhttps://github.com/traefik/traefik/releases/tag/v3.7.12\n","aliases":"CVE-2026-88012\nGHSA-7ghq-v6jf-g56c\n","assigner":"GitHub_M","epss":0.52,"enisaIdProduct":[{"id":"8a48603a-1762-33ae-a364-cd4ff37e10aa","product":{"name":"traefik","vendor":{"name":"traefik"}},"product_version":"2.8.2, \u003c 2.11.56"},{"id":"9badb774-02aa-31d2-a9f0-09394b901eb3","product":{"name":"traefik","vendor":{"name":"traefik"}},"product_version":"3.0.0, \u003c 3.7.12"}],"enisaIdVendor":[{"id":"b5a5247e-2da0-3702-a1f9-430bae13236b","vendor":{"name":"traefik"}}],"enisaIdVulnerability":[{"id":"dd8e376f-4692-3a1d-bf74-b94832b32b8d","vulnerability":{"id":"GHSA-7ghq-v6jf-g56c","description":"Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded","datePublished":"Sep 10, 2026, 8:27:16 PM","dateUpdated":"Sep 10, 2026, 8:27:16 PM","baseScore":0.0,"references":"https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-88012\nhttps://github.com/traefik/traefik/pull/13717\nhttps://github.com/traefik/traefik/commit/a8d0bc425859dde7481a6c9a324e610b81d754d0\nhttps://github.com/traefik/traefik\nhttps://github.com/traefik/traefik/releases/tag/v2.11.56\nhttps://github.com/traefik/traefik/releases/tag/v3.7.12\n","enisa_id":"EUVD-2026-75562\n","aliases":"GHSA-7ghq-v6jf-g56c\nCVE-2026-88012\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"eed2f7b5-c165-3fea-b58f-b24fc2825aa3","vulnerability":{"id":"CVE-2026-88012","description":"Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream deadline. An unauthenticated client can use a slow request body, trickling data indefinitely while holding a request and an upstream connection open and exhausting backends with bounded connection pools. This issue is fixed in 2.11.56 and 3.7.12.","datePublished":"Sep 10, 2026, 3:35:12 PM","dateUpdated":"Sep 11, 2026, 8:33:29 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c\nhttps://github.com/traefik/traefik/pull/13717\nhttps://github.com/traefik/traefik/commit/a8d0bc425859dde7481a6c9a324e610b81d754d0\nhttps://github.com/traefik/traefik/releases/tag/v2.11.56\nhttps://github.com/traefik/traefik/releases/tag/v3.7.12\n","enisa_id":"EUVD-2026-75562\n","assigner":"GitHub_M","epss":0.52,"dataProcessed":"Oct 30, 2026, 7:14:20 AM","vulnerabilityProduct":[{"id":"07b50841-e7cb-3183-8404-71a568c0ce92","product":{"name":"traefik","vendor":{"name":"traefik"}},"product_version":"2.8.2, \u003c 2.11.56"},{"id":"6e88cac9-f61c-31a1-bbdb-758c1b112b8d","product":{"name":"traefik","vendor":{"name":"traefik"}},"product_version":"3.0.0, \u003c 3.7.12"}],"vulnerabilityVendor":[{"id":"f48c85ec-9d54-3c92-9f1a-9bd1b29264f3","vendor":{"name":"traefik"}}]}}],"enisaIdAdvisory":[]}