CVE-2026-88012

Katalog CVE

CVSS 5.3 · Medium EPSS 0,52%

Kerentanan Allocation of Resources Without Limits or Throttling pada traefik. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream deadline. An unauthenticated client can use a slow request body, trickling data indefinitely while holding a request and an upstream connection open and exhausting backends with bounded connection pools. This issue is fixed in 2.11.56 and 3.7.12.

Rincian

Terbit di NVD

10 September 2026

Terakhir diubah

14 September 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c patch · advisory vendor
• https://github.com/traefik/traefik/commit/a8d0bc425859dde7481a6c9a324e610b81d754d0 patch
• https://github.com/traefik/traefik/pull/13717 issue tracking · patch
• https://github.com/traefik/traefik/releases/tag/v2.11.56 patch · release notes
• https://github.com/traefik/traefik/releases/tag/v3.7.12 patch · release notes