| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/traefik/traefik | < 2.11.2all versions | 2.11.2 |
| github.com/traefik/traefik/v2 | < 2.11.2 | 2.11.2 |
| github.com/traefik/traefik/v3 | ≥ 3.0.0-beta3, < 3.0.0-rc5 | 3.0.0-rc5 |
| traefik | = 3.0.0< 2.11.2 | 2.11.2 |
There is a potential vulnerability in Traefik managing requests with Content-length and no body .
Sending a GET request to any Traefik endpoint with the Content-length request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service.
For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.
If you have any questions or comments about this advisory, please open an issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free