CVE-2026-88878: Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass

Published Sep 10, 2026
·
Updated

Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and >= v3.0.0 through <= v3.7.11, the entryPoints.<name>.transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying TCP connection, which cannot be applied to a QUIC stream, and Traefik's HTTP/3 server is constructed without any timeout. As a result, on entry points with HTTP/3 enabled, an unauthenticated remote client that trickles request body bytes can hold a request open indefinitely and, with it, one upstream connection per request, exhausting bounded backend connection pools and causing denial of service. The issue was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that carried these timeouts. Fixed in v2.11.56 and v3.7.12.

Affected Software

1 affected component
Traefik traefik>=v2.8.2<=v2.11.55, >=v3.0.0<=v3.7.11

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.11.56
  2. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 3.7.12

Event History

Sep 10, 2026
CVE Published
via MITRE·01:05 PM
Data Sourced
via MITRE·01:05 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which deployments are exposed?

Deployments running affected Traefik versions are exposed only on entry points where HTTP/3 is enabled. The impact is most significant where upstream or backend connection pools are bounded, because each held request can consume one upstream connection.

2

What does an attacker need to do to exploit this?

An unauthenticated remote client must be able to reach an HTTP/3-enabled entry point. The client can trickle request-body bytes to keep requests open indefinitely and consume backend connections.

3

Are default timeout settings sufficient to prevent this?

No. Although readTimeout is enabled by default at 60 seconds, it is not applied to the HTTP/3 request path, so it does not limit these slow request bodies.

4

What can be done before upgrading?

Disable HTTP/3 on affected entry points if that is operationally feasible. This prevents requests from using the HTTP/3 path where respondingTimeouts are not enforced.

5

Which versions contain the fix?

The issue is fixed in Traefik v2.11.56 and v3.7.12.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203