CVE-2026-88012

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Published

Sep 10, 2026, 2:17:16 PM UTC

Updated

Sep 10, 2026, 4:18:08 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.52% · Oct 25, 2026

A flaw was found in Traefik, an open-source HTTP reverse proxy and load balancer. Its HTTP/3 entrypoints do not correctly apply read timeouts, which are intended to prevent prolonged connections. An unauthenticated client can exploit this by sending a slow request body, continuously trickling data. This allows the client to hold open a request and an upstream connection indefinitely, potentially exhausting backend connection pools and leading to a Denial of Service (DoS). traefik: Traefik: Denial of Service via slow HTTP/3 request bodies A flaw in Traefik's HTTP/3 implementation allows unauthenticated remote attackers to cause a denial of service against upstream services. Traefik fails to enforce read timeouts (respondingTimeouts.readTimeout) on HTTP/3 entrypoints due to missing QUIC stream deadline enforcement. An attacker can transmit slow request bodies to hold HTTP/3 connections open indefinitely, consuming available proxy resources and exhausting backend connection pools under default operational limits. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.