Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the Content-length request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.
Weakness
The product does not handle or incorrectly handles an exceptional condition.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Traefik | Traefik | * | 2.11.2 (excluding) |
| Traefik | Traefik | 3.0.0 (including) | 3.0.0 (including) |
| Traefik | Traefik | 3.0.0-beta1 (including) | 3.0.0-beta1 (including) |
| Traefik | Traefik | 3.0.0-beta2 (including) | 3.0.0-beta2 (including) |
| Traefik | Traefik | 3.0.0-beta3 (including) | 3.0.0-beta3 (including) |
| Traefik | Traefik | 3.0.0-beta4 (including) | 3.0.0-beta4 (including) |
| Traefik | Traefik | 3.0.0-beta5 (including) | 3.0.0-beta5 (including) |
| Traefik | Traefik | 3.0.0-rc1 (including) | 3.0.0-rc1 (including) |
| Traefik | Traefik | 3.0.0-rc2 (including) | 3.0.0-rc2 (including) |
| Traefik | Traefik | 3.0.0-rc3 (including) | 3.0.0-rc3 (including) |
| Traefik | Traefik | 3.0.0-rc4 (including) | 3.0.0-rc4 (including) |
| Red Hat OpenShift Dev Spaces (RHOSDS) 3.23 | RedHat | devspaces/traefik-rhel9:sha256:f17428eced9d6bec1eaaa1510b68250824d3ace2f66af7f31fbf7327ca11540c | * |
References
- https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts
- https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6
- https://github.com/traefik/traefik/releases/tag/v2.11.2
- https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5
- https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw
- https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts
- https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6
- https://github.com/traefik/traefik/releases/tag/v2.11.2
- https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5
- https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw