https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 11:32:23 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-88878 <p>Traefik is an HTTP reverse proxy and load balancer. In versions &gt;= v2.8.2 through &lt;= v2.11.55 and &gt;= v3.0.0 through &lt;= v3.7.11, the entryPoints.&lt;name&gt;.transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying TCP connection, which cannot be applied to a QUIC stream, and Traefik&#39;s HTTP/3 server is constructed without any timeout. As a result, on entry points with HTTP/3 enabled, an unauthenticated remote client that trickles request body bytes can hold a request open indefinitely and, with it, one upstream connection per request, exhausting bounded backend connection pools and causing denial of service. The issue was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that carried these timeouts. Fixed in v2.11.56 and v3.7.12.</p> <p>Traefik is an HTTP reverse proxy and load balancer. In versions &gt;= v2.8.2 through &lt;= v2.11.55 and &gt;= v3.0.0 through &lt;= v3.7.11, the entryPoints.&lt;name&gt;.transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying TCP connection, which cannot be applied to a QUIC stream, and Traefik&#39;s HTTP/3 server is constructed without any timeout. As a result, on entry points with HTTP/3 enabled, an unauthenticated remote client that trickles request body bytes can hold a request open indefinitely and, with it, one upstream connection per request, exhausting bounded backend connection pools and causing denial of service. The issue was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that carried these timeouts. Fixed in v2.11.56 and v3.7.12.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-88878 https://vulnerability.circl.lu/vuln/ghsa-c9gw-2969-4fg3 <p>Traefik is an HTTP reverse proxy and load balancer. In versions &gt;= v2.8.2 through &lt;= v2.11.55 and &gt;= v3.0.0 through &lt;= v3.7.11, the entryPoints.&lt;name&gt;.transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying TCP connection, which cannot be applied to a QUIC stream, and Traefik&#39;s HTTP/3 server is constructed without any timeout. As a result, on entry points with HTTP/3 enabled, an unauthenticated remote client that trickles request body bytes can hold a request open indefinitely and, with it, one upstream connection per request, exhausting bounded backend connection pools and causing denial of service. The issue was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that carried these timeouts. Fixed in v2.11.56 and v3.7.12.</p> <p>Traefik is an HTTP reverse proxy and load balancer. In versions &gt;= v2.8.2 through &lt;= v2.11.55 and &gt;= v3.0.0 through &lt;= v3.7.11, the entryPoints.&lt;name&gt;.transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying TCP connection, which cannot be applied to a QUIC stream, and Traefik&#39;s HTTP/3 server is constructed without any timeout. As a result, on entry points with HTTP/3 enabled, an unauthenticated remote client that trickles request body bytes can hold a request open indefinitely and, with it, one upstream connection per request, exhausting bounded backend connection pools and causing denial of service. The issue was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that carried these timeouts. Fixed in v2.11.56 and v3.7.12.</p> https://vulnerability.circl.lu/vuln/ghsa-c9gw-2969-4fg3