Threats tagged 'ghsa-7ghq-v6jf-g56c'

A medium severity vulnerability in Traefik affects HTTP/3 entry points where the respondingTimeouts.readTimeout setting is not applied. This setting, which limits the time to read the entire request including its body, works for HTTP/1.1 and HTTP/2 but is ineffective for HTTP/3 due to architectural differences. As a result, an unauthenticated client can keep a request open indefinitely by trickling the request body slowly, consuming upstream connections and potentially exhausting backend connection pools. The issue affects Traefik versions from 2.8.2 up to but not including 2.11.56, and from 3.0.0 up to but not including 3.7.12. Patches are available in versions 2.11.56 and 3.7.12.