CVE-2024-28869
EUVD-2024-109512.04.2024, 22:15
Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| traefik | traefik | 𝑥 < 2.11.2 |
| traefik | traefik | 3.0.0 |
| traefik | traefik | 3.0.0:beta1 |
| traefik | traefik | 3.0.0:beta2 |
| traefik | traefik | 3.0.0:beta3 |
| traefik | traefik | 3.0.0:beta4 |
| traefik | traefik | 3.0.0:beta5 |
| traefik | traefik | 3.0.0:rc1 |
| traefik | traefik | 3.0.0:rc2 |
| traefik | traefik | 3.0.0:rc3 |
| traefik | traefik | 3.0.0:rc4 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| traefik | traefik | 𝑥 < 2.11.2 | ADP |
| traefik | traefik | 𝑥 ≤ 3.0.0-rc3 | ADP |
Common Weakness Enumeration
References