CVE-2026-88012Published

Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded

cve-program · CVE-2026-88012

Published

traefik

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "traefik",
                    "product": "traefik",
                    "versions": [
                        {
                            "version": ">= 2.8.2, < 2.11.56",
                            "status": "affected"
                        },
                        {
                            "version": ">= 3.0.0, < 3.7.12",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

cve-program · CVE-2026-88878

Published

traefik

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "traefik",
                    "product": "traefik",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:golang/github.com/traefik/traefik/v2",
                    "versions": [
                        {
                            "version": "2.8.2",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThanOrEqual": "3.7.13"
                        }
                    ]
                }

traefik

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "traefik",
                    "product": "traefik",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:golang/github.com/traefik/traefik/v3",
                    "versions": [
                        {
                            "version": "3.0.0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThanOrEqual": "3.7.13"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-75428

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Sep 10, 2026, 1:05:30 PM

dateUpdated: Oct 8, 2026, 3:25:58 PM

1 related source bulletins · separate from aliases

RHSA-2026:90321: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.31.0 Release.

CVE-2023-54404 · CVE-2025-62718 · CVE-2026-8643 · CVE-2026-9496 · CVE-2026-12185 · CVE-2026-13697 · CVE-2026-14682 · CVE-2026-15076 · CVE-2026-16308 · CVE-2026-17106 · CVE-2026-18427 · CVE-2026-19203 · CVE-2026-19534 · CVE-2026-39820 · CVE-2026-41178 · CVE-2026-41707 · CVE-2026-42499 · CVE-2026-42502 · CVE-2026-45416 · CVE-2026-47884 · CVE-2026-47886 · CVE-2026-47888 · CVE-2026-47890 · CVE-2026-47892 · CVE-2026-50010 · CVE-2026-55831 · CVE-2026-55833 · CVE-2026-55851 · CVE-2026-56745 · CVE-2026-56746 · CVE-2026-56819 · CVE-2026-56852 · CVE-2026-56854 · CVE-2026-58062 · CVE-2026-59280 · CVE-2026-59282 · CVE-2026-59283 · CVE-2026-59296 · CVE-2026-59313 · CVE-2026-59323 · CVE-2026-59651 · CVE-2026-59887 · CVE-2026-59899 · CVE-2026-59901 · CVE-2026-62243 · CVE-2026-64607 · CVE-2026-67213 · CVE-2026-67312 · CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-68494 · CVE-2026-68497 · CVE-2026-69152 · CVE-2026-69192 · CVE-2026-71290 · CVE-2026-71324 · CVE-2026-71325 · CVE-2026-71327 · CVE-2026-73500 · CVE-2026-73508 · CVE-2026-74835 · CVE-2026-75838 · CVE-2026-75899 · CVE-2026-75931 · CVE-2026-76169 · CVE-2026-81521 · CVE-2026-82417 · CVE-2026-82562 · CVE-2026-84292 · CVE-2026-84375 · CVE-2026-84394 · CVE-2026-84428 · CVE-2026-84445 · CVE-2026-84469 · CVE-2026-84504 · CVE-2026-84961 · CVE-2026-85062 · CVE-2026-85124 · CVE-2026-85152 · CVE-2026-85595 · CVE-2026-85597 · CVE-2026-86063 · CVE-2026-87743 · CVE-2026-88004 · CVE-2026-88007 · CVE-2026-88008 · CVE-2026-88009 · CVE-2026-88011 · CVE-2026-88012 · CVE-2026-88031 · CVE-2026-88878 · CVE-2026-88879 · CVE-2026-90711 · CVE-2026-93749 · CVE-2026-100655 · CVE-2026-100656 · CVE-2026-100666 · CVE-2026-101916 · CVE-2026-102925 · CVE-2026-102930 · CVE-2026-103435 · CVE-2026-109618 · CVE-2026-109619

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-75562

Published

Original publisher date fields

datePublished: Sep 10, 2026, 3:35:12 PM

dateUpdated: Sep 11, 2026, 8:33:29 PM

1 related source bulletins · separate from aliases

RHSA-2026:90321: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.31.0 Release.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-88012

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-770

Original publisher date fields

published: 2026-09-10T16:18:08.067

lastModified: 2026-09-14T20:00:02.687

1 source CPE criteria · context only

cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-88878

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-770

Original publisher date fields

published: 2026-09-10T14:17:16.173

lastModified: 2026-10-08T16:17:58.807

1 source CPE criteria · context only

cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-7ghq-v6jf-g56c

Published

github.com/traefik/traefik/v2

SEMVER · introduced 2.8.2 → fixed 2.11.56

github.com/traefik/traefik/v3

SEMVER · introduced 3.0.0 → fixed 3.7.12

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GO-2026-6454

Published

github.com/traefik/traefik

SEMVER · introduced 0

github.com/traefik/traefik/v2

SEMVER · introduced 2.8.2 → fixed 2.11.56

github.com/traefik/traefik/v3

SEMVER · introduced 3.0.0 → fixed 3.7.12

Original source record · Cite this exact observation · Complete original publisher JSON