Most recent entries from all

bdu:2024-03542

EUVD-2026-4553

fkie_cve-2024-28869

Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.

GHSA-4vwx-54mw-vqfw — Traefik vulnerable to denial of service with Content-length header

Affected: Go: github.com/traefik/traefik/v3, Go: github.com/traefik/traefik/v2, Go: github.com/traefik/traefik

There is a potential vulnerability in Traefik managing requests with `Content-length` and no `body` .

Sending a `GET` request to any Traefik endpoint with the `Content-length` request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service.

## Patches

- https://github.com/traefik/traefik/releases/tag/v2.11.2 - https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5

## Workarounds

For affected versions, this vulnerability can be mitigated by configuring the [readTimeout](https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts) option.

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

gsd-2024-28869

openSUSE-SU-2024:13927-1 — traefik-2.11.2-1.1 on GA media

traefik-2.11.2-1.1 on GA media

RHSA-2025:15847 — Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.23.0 Release.

hashicorp/consul: consul: Consul L7 Intentions Vulnerable To URL Path Bypass hashicorp/consul: consul: Consul L7 Intentions Vulnerable To Headers Bypass quic-go: memory exhaustion attack against QUIC's connection ID mechanism golang: archive/zip: Incorrect handling of certain ZIP files traefik: denial of service traefik: Bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html cipher-base: Cipher-base hash manipulation sha.js: Missing type checks leading to hash rewind and passing on crafted data git: Git arbitrary file writes tar-fs: tar-fs has issue where extract can write outside the specified dir with a specific tarball com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError