Skip to content
OpenAdvisories
High · 7.5 CVE-2024-28869 EUVD-2024-1095GHSA-4vwx-54mw-vqfwGO-2024-2722

Possible denial of service vulnerability with Content-length header in Traefik

Published Apr 12, 2024 · Updated Aug 2, 2024 · Assigned by GitHub_M

Vendor: traefik Product: traefik Package: github.com/traefik/traefik Package: github.com/traefik/traefik/v2 Package: github.com/traefik/traefik/v3 Ecosystem: Go

Description

Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.

Affected products

VendorProductAffectedFixed
traefik traefik < 2.11.2, >= 3.0.0-rc1, < 3.0.0-rc5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed traefik 2.11.2-1.1 openSUSE-SU-2024:13927-1
openSUSE Tumbleweed traefik2 2.11.5-1.1 openSUSE-SU-2024:14076-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/traefik/traefik < 2.11.2 2.11.2 GHSA-4vwx-54mw-vqfw
Go github.com/traefik/traefik all versions — GO-2024-2722
Go github.com/traefik/traefik/v2 < 2.11.2 2.11.2 GHSA-4vwx-54mw-vqfw
Go github.com/traefik/traefik/v3 >= 3.0.0-beta3, < 3.0.0-rc5 3.0.0-rc5 GHSA-4vwx-54mw-vqfw

Advisories 2

References