{"id":"GO-2026-6454","revision":"7a7dd8ac9de64bfa90a83ee57581863b","records":[{"revision":"7a7dd8ac9de64bfa90a83ee57581863b","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6454","aliases":["CVE-2026-88012","CVE-2026-88878","GHSA-7ghq-v6jf-g56c"],"title":"Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded in github.com/traefik/traefik","description":"Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded in github.com/traefik/traefik","state":0,"publishedAt":"2026-09-16T16:56:22+00:00","modifiedAt":"2026-09-17T17:40:37.4238642+00:00","affected":[{"ecosystem":"Go","name":"github.com/traefik/traefik","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/traefik/traefik/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.8.2"},{"kind":"fixed","version":"2.11.56"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/traefik/traefik/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.7.12"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c","https://nvd.nist.gov/vuln/detail/CVE-2026-88012","https://github.com/traefik/traefik/commit/a8d0bc425859dde7481a6c9a324e610b81d754d0","https://github.com/traefik/traefik/pull/13717","https://github.com/traefik/traefik/releases/tag/v2.11.56","https://github.com/traefik/traefik/releases/tag/v3.7.12"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6454","license":"OSV · upstream source license applies","key":"osv:GO-2026-6454","identifiers":["GO-2026-6454","CVE-2026-88012","CVE-2026-88878","GHSA-7ghq-v6jf-g56c"]},"retained":false,"historicalAffected":[]}],"coverage":[]}