CVE-2024-28869

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-755

Affected software

Vendor	Product	Versions
traefik	traefik	< 2.11.2; >= 3.0.0-rc1, < 3.0.0-rc5
traefik	traefik	< 2.11.2; <= 3.0.0-rc3

References

https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeoutsProduct
https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6Patch
https://github.com/traefik/traefik/releases/tag/v2.11.2Release Notes
https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5Release Notes
https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfwPatch, Vendor Advisory
https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeoutsProduct
https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6Patch
https://github.com/traefik/traefik/releases/tag/v2.11.2Release Notes
https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5Release Notes
https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfwPatch, Vendor Advisory

Timeline

Published: Apr 12, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-28877.7Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTML CVE-2024-288707.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF a CVE-2024-288717.5LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Version 0.5.46 may parse malformed request traffic,CVE-2024-288728.1The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the S CVE-2024-288758.1A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the CVE-2024-288767.3Uncontrolled search path for some Intel(R) MPI Library software before version 2021.12 may allow an authenticated user to potentially enable CVE-2024-288778.8MicroDicom DICOM Viewer is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code on affected in CVE-2024-288789.6IO-1020 Micro ELD downloads source code or an executable from an adjacent location and executes the code without sufficiently verifying th CVE-2024-28885.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Post and Page Builder by Bold CVE-2024-288806.5Path traversal vulnerability in MosP kintai kanri V4.6.6 and earlier allows a remote attacker who can log in to the product to obtain sensit CVE-2024-288816.7Uncontrolled search path for some Intel(R) Fortran Compiler Classic software before version 2021.13 may allow an authenticated user to poten CVE-2024-288824.3OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the vali