CVE-2026-88012
Received Received - Intake

HTTP/3 Slow Request Body Denial of Service in Traefik

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream deadline. An unauthenticated client can use a slow request body, trickling data indefinitely while holding a request and an upstream connection open and exhausting backends with bounded connection pools. This issue is fixed in 2.11.56 and 3.7.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88012
EUVD
EUVD-2026-75562

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
traefik traefik to 2.11.56 (inc)
traefik traefik 2.11.56
traefik traefik 3.7.12
traefik traefik 2.8.2
traefik traefik to 2.11.56 (exc)
traefik traefik to 3.7.12 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Traefik, an open source HTTP reverse proxy and load balancer. HTTP/3 entrypoints do not enforce the readTimeout setting, which is supposed to limit how long a server waits to read an entire HTTP request including its body. This timeout is ignored for HTTP/3 requests, allowing unauthenticated clients to trickle data indefinitely while holding connections open. This can exhaust backend connection pools.

Detection Guidance

To detect this vulnerability, check if Traefik is running with HTTP/3 enabled and if the version is between 2.8.2-2.11.55 or 3.0.0-3.7.11. Inspect Traefik logs for slow or indefinite request bodies over HTTP/3. Use commands like 'curl -v --http3 https://your-traefik-host' to test HTTP/3 connectivity.

Impact Analysis

An attacker can exploit this to perform a denial-of-service attack by keeping connections open for extended periods with minimal effort. This consumes upstream resources and may exhaust connection pools in backend services, leading to degraded performance or outages.

Compliance Impact

This vulnerability primarily impacts availability by allowing denial-of-service through resource exhaustion, which could indirectly affect compliance with standards like GDPR or HIPAA that require availability of personal or health data systems. However, the provided context does not explicitly link this issue to specific compliance failures or data protection requirements.

Mitigation Strategies

Upgrade Traefik to version 2.11.56 or 3.7.12 or later. Disable HTTP/3 if not required. Monitor network traffic for unusual slow requests. Apply network-level timeouts to block prolonged connections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88012. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart