HTTP/3 Timeout Bypass Vulnerability in Traefik by Containous
CVE-2026-88878

6.9MEDIUM

Key Information:

Vendor

Traefik

Status
Traefik
Vendor
CVE Published:
10 September 2026

What is CVE-2026-88878?

The Traefik HTTP reverse proxy and load balancer has a vulnerability that allows unauthenticated remote clients to exploit the HTTP/3 request path. This issue arises from the entryPoints..transport.respondingTimeouts settings not being applied to HTTP/3 requests, particularly the readTimeout, which defaults to 60 seconds. As a result, clients can indefinitely keep requests open, leading to exhaustion of backend connection pools and potential denial of service. The flaw was introduced in version 2.8.2 due to a change in the quic-go API and has been resolved in versions 2.11.56 and 3.7.12.

Affected Version(s)

traefik 2.8.2 <= 3.7.13

traefik 3.0.0 <= 3.7.13

References

https://github.com/traefik/traefik/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/traefik-2.8.2-throug...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ShadMalloy
.