There is a potential vulnerability in Traefik managing requests with Content-length and no body .

Sending a GET request to any Traefik endpoint with the Content-length request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service.

Patches

• https://github.com/traefik/traefik/releases/tag/v2.11.2
• https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5

Workarounds

For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.

For more information

If you have any questions or comments about this advisory, please open an issue.

References

• GHSA-4vwx-54mw-vqfw
• https://github.com/traefik/traefik/releases/tag/v2.11.2
• https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5
• https://nvd.nist.gov/vuln/detail/CVE-2024-28869
• traefik/traefik@240b83b
• https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts