VulnSocial

CVE-2026-88878General(traefik / traefik)

LOWCVSS 6.9 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and >= v3.0.0 through <= v3.7.11, the entryPoints.<name>.transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying TCP connection, which cannot be applied to a QUIC stream, and Traefik's HTTP/3 server is constructed without any timeout. As a result, on entry points with HTTP/3 enabled, an unauthenticated remote client that trickles request body bytes can hold a request open indefinitely and, with it, one upstream connection per request, exhausting bounded backend connection pools and causing denial of service. The issue was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that carried these timeouts. Fixed in v2.11.56 and v3.7.12.

traefik CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Weakness type (CWE)
CWE-770

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • traefik

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • General: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
traefik
Products
traefik

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-11: 1Technical Details · 2026-09-11: 109-11
Signal classification1 categories
General
1100.0%
Referenced assets1 URL
Full discourse1 post
  • NewNormal Security@NewScanTeam
    General

    NewNormal Security turns the last 24 hours of CVEs into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 11 Sep 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 📦 Reverse proxy on a build named in this week's advisories — reach the protected backend with none of its auth, allowlist or rate-limit middleware (Traefik CVE-2026-88877, CVE-2026-88007, CVE-2026-88009, CVE-2026-88008, CVE-2026-88004, CVE-2026-88878, CVE-2026-88879, CVE-2026-88011, CVE-2026-88012) 🔓 Authorization written as a list of HTTP verbs, with one verb missing from the list — send the same request as PATCH and the access check never runs (OpenNMS CVE-2026-89054) 🕳️ Media-server plugin status page answering anonymously — read the host's binary paths, open ports and plugin log without logging in (WWBN AVideo CVE-2026-89248) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #AuthBypass #CSO #REDTEAM

    Post summary

    The tweet lists several CVEs with short exploitation notes and promotes NewScan for detection, but includes no PoC, exploit code, patches, or active‑exploitation evidence.

    0000051
    7 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Apptraefiktraefik---

Explore more

Back to dashboardtraefik CVEstraefik vulnerabilities