Description
Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream deadline. An unauthenticated client can use a slow request body, trickling data indefinitely while holding a request and an upstream connection open and exhausting backends with bounded connection pools. This issue is fixed in 2.11.56 and 3.7.12.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| traefik | traefik | >= 2.8.2, < 2.11.56, >= 3.0.0, < 3.7.12 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 | SUSE-SU-2026:23863-1, SUSE-SU-2026:23855-1 |
| SLES 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 | SUSE-SU-2026:23863-1, SUSE-SU-2026:23855-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 | openSUSE-SU-2026:21897-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | traefik-3.6 | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/traefik/traefik | all versions | — | GO-2026-6454 |
| Go | github.com/traefik/traefik/v2 | >= 2.8.2, < 2.11.56 | 2.11.56 | GHSA-7ghq-v6jf-g56c |
| Go | github.com/traefik/traefik/v3 | >= 3.0.0, < 3.7.12 | 3.7.12 | GHSA-7ghq-v6jf-g56c |
Advisories 3
- SUSE-SU-2026:23863-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 27, 2026
- SUSE-SU-2026:23855-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 27, 2026
- openSUSE-SU-2026:21897-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 25, 2026
References
- https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c
- https://github.com/traefik/traefik/pull/13717
- https://github.com/traefik/traefik/commit/a8d0bc425859dde7481a6c9a324e610b81d754d0
- https://github.com/traefik/traefik/releases/tag/v2.11.56
- https://github.com/traefik/traefik/releases/tag/v3.7.12