Traefik Vulnerability Discovered in Version Through 3.7.11
Traefik Vulnerability Discovered in Version Through 3.7.11
🚨 Bishop Fox has identified a significant vulnerability in Traefik, an open-source reverse proxy and ingress controller widely used in container and Kubernetes environments. This vulnerability, tracked as GHSA-7ghq-v6jf-g56c, allows an unauthenticated remote user to hold requests open indefinitely, potentially denying service to legitimate traffic.
Details of the Vulnerability
The vulnerability is categorized as uncontrolled resource consumption with a medium security risk, and it affects versions 2.8.2 through 2.11.55 and 3.0.0 through 3.7.11. The issue arises because Traefik’s HTTP/3 server was constructed without a timeout, which means the default request read timeout of 60 seconds does not apply to HTTP/3 connections.
Impact
Each held request occupies one upstream connection for as long as the client chooses, which can lead to service denial for legitimate users. The traffic remains well-formed and low in volume, making it difficult for rate-based defenses to identify it as an attack.
Recommendations
Organizations running affected versions must update to version 2.11.56 or 3.7.12. Versions 2.8.2 through 2.10.x and 3.0 through 3.6 have reached end of maintenance and will not receive a patch on their own branches; therefore, organizations must move to a supported branch to obtain the fix.
Timeline
- Vulnerability Discovered: 08/10/2026
- Fixed Versions Released: 08/26/2026
- Public Disclosure: 08/28/2026
For more information, please read the complete article here: Read full article