CVE-2026-88878: Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass
Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and >= v3.0.0 through <= v3.7.11, the entryPoints.<name>.transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying TCP connection, which cannot be applied to a QUIC stream, and Traefik's HTTP/3 server is constructed without any timeout. As a result, on entry points with HTTP/3 enabled, an unauthenticated remote client that trickles request body bytes can hold a request open indefinitely and, with it, one upstream connection per request, exhausting bounded backend connection pools and causing denial of service. The issue was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that carried these timeouts. Fixed in v2.11.56 and v3.7.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.11.56 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.7.12
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running affected Traefik versions are exposed only on entry points where HTTP/3 is enabled. The impact is most significant where upstream or backend connection pools are bounded, because each held request can consume one upstream connection.
What does an attacker need to do to exploit this?
An unauthenticated remote client must be able to reach an HTTP/3-enabled entry point. The client can trickle request-body bytes to keep requests open indefinitely and consume backend connections.
Are default timeout settings sufficient to prevent this?
No. Although readTimeout is enabled by default at 60 seconds, it is not applied to the HTTP/3 request path, so it does not limit these slow request bodies.
What can be done before upgrading?
Disable HTTP/3 on affected entry points if that is operationally feasible. This prevents requests from using the HTTP/3 path where respondingTimeouts are not enforced.
Which versions contain the fix?
The issue is fixed in Traefik v2.11.56 and v3.7.12.