CVE-2026-88012

MediumCVSS 5.3/10Last modified Sep 14, 2026

Description

Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream deadline. An unauthenticated client can use a slow request body, trickling data indefinitely while holding a request and an upstream connection open and exhausting backends with bounded connection pools. This issue is fixed in 2.11.56 and 3.7.12.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
traefik	traefik	>= 2.8.2, < 2.11.56; >= 3.0.0, < 3.7.12

References

https://github.com/traefik/traefik/commit/a8d0bc425859dde7481a6c9a324e610b81d754d0Patch
https://github.com/traefik/traefik/pull/13717Issue Tracking, Patch
https://github.com/traefik/traefik/releases/tag/v2.11.56Patch, Release Notes
https://github.com/traefik/traefik/releases/tag/v3.7.12Patch, Release Notes
https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56cPatch, Vendor Advisory

Timeline

Published: Sep 10, 2026
Last modified: Sep 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-880135.3rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the CVE-2026-880146.3rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the CVE-2026-880155.3rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local CVE-2026-880167.1rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/CVE-2026-880177.3rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the CVE-2026-880189.8rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve CVE-2026-88024.3A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This issue affects the function getPicThumb of the file CVE-2026-880206.1Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interfa CVE-2026-880217.1Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a desti CVE-2026-880227.7Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an exp CVE-2026-880238.3Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-suppli CVE-2026-880248.3Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-suppli