CVE-2024-28869: Possible denial of service vulnerability with Content-length header in Traefik
There is a potential vulnerability in Traefik managing requests with Content-length and no body .
Sending a GET request to any Traefik endpoint with the Content-length request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service.
Patches
- https://github.com/traefik/traefik/releases/tag/v2.11.2 - https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5
Workarounds
For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.
For more information
If you have any questions or comments about this advisory, please open an issue.
Other sources
Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28869?
CVE-2024-28869 is considered a moderate severity vulnerability that can lead to indefinite hanging of requests.
How do I fix CVE-2024-28869?
To fix CVE-2024-28869, update Traefik to version 2.11.2 or above, or 3.0.0-rc5 or above.
What versions of Traefik are affected by CVE-2024-28869?
CVE-2024-28869 affects Traefik versions up to and including 2.11.1 and versions between 3.0.0-beta3 and 3.0.0-rc4.
What is the nature of the vulnerability in CVE-2024-28869?
The vulnerability in CVE-2024-28869 occurs when Traefik incorrectly handles GET requests with a Content-Length header and no body, resulting in indefinite hangs.
Is there a workaround for CVE-2024-28869 before applying the patch?
Currently, there is no documented workaround for CVE-2024-28869 other than upgrading to the fixed versions.