PT-2024-3308 · Traefik+1 · Traefik+1
Prajithp
·
Published
2024-03-11
·
Updated
2025-11-26
·
CVE-2024-28869
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Traefik versions prior to 2.11.2
Traefik versions prior to 3.0.0-rc5
Description
The issue is related to insufficient handling of exceptional states when processing Content-Length headers, resulting in an indefinite hang with the default configuration. This can be exploited by attackers to induce a denial of service. Sending a GET request to any Traefik endpoint with the
Content-length request header results in this hang.Recommendations
For versions prior to 2.11.2, upgrade to version 2.11.2 or later.
For versions prior to 3.0.0-rc5, upgrade to version 3.0.0-rc5 or later.
As a temporary workaround, consider configuring the
readTimeout option to mitigate the vulnerability.Exploit
Fix
DoS
Improper Resource Release
Improper Handling of Exceptional Conditions
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Traefik