Traefik Vulnerability: Indefinite Hang with Default Configuration
CVE-2024-28869
7.5HIGH
What is CVE-2024-28869?
The vulnerability allows attackers to exploit Traefik, an HTTP reverse proxy and load balancer, by sending specially crafted GET requests with the 'Content-length' header. This results in the Traefik service hanging indefinitely under default configuration settings, leading to a denial of service. To mitigate this issue, users are advised to upgrade to Traefik versions 2.11.2 or 3.0.0-rc5. Additionally, modifying the 'readTimeout' option can help mitigate the effects of this vulnerability in affected versions.
Affected Version(s)
traefik < 2.11.2 < 2.11.2
traefik >= 3.0.0-rc1, < 3.0.0-rc5 < 3.0.0-rc1, 3.0.0-rc5