Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream deadline. An unauthenticated client can use a slow request body, trickling data indefinitely while holding a request and an upstream connection open and exhausting backends with bounded connection pools. This issue is fixed in 2.11.56 and 3.7.12.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12,
    HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout
    is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream deadline. An
    unauthenticated client can use a slow request body, trickling data indefinitely while holding a request
    and an upstream connection open and exhausting backends with bounded connection pools. This issue is fixed
    in 2.11.56 and 3.7.12. (CVE-2026-88012)

ID	Name	Product	Family	Type	Severity
459252	Echo: github.com/traefik/traefik/v3: security update to 2.11.56	Tenable Cloud Security	Echo Local Security Checks	Local	medium
459252	Echo: github.com/traefik/traefik/v3: security update to 2.11.56	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
447938	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-7ghq-v6jf-g56c)	Tenable Cloud Security	SCA Checks	Local	medium
447938	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-7ghq-v6jf-g56c)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-88012

medium

Tenable Plugins

medium

medium

medium

medium