Traefik · Traefik · CVE-2024-28869
**Name of the Vulnerable Software and Affected Versions**
Traefik versions prior to 2.11.2
Traefik versions prior to 3.0.0-rc5
**Description**
The issue is related to insufficient handling of exceptional states when processing Content-Length headers, resulting in an indefinite hang with the default configuration. This can be exploited by attackers to induce a denial of service. Sending a GET request to any Traefik endpoint with the `Content-length` request header results in this hang.
**Recommendations**
For versions prior to 2.11.2, upgrade to version 2.11.2 or later.
For versions prior to 3.0.0-rc5, upgrade to version 3.0.0-rc5 or later.
As a temporary workaround, consider configuring the `readTimeout` option to mitigate the vulnerability.