Description

Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.

INFO

Published Date :

2024-04-12T21:08:36.288Z

Last Modified :

2024-08-02T00:56:58.412Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2024-28869 vulnerability.

Vendors Products
Traefik
  • Traefik
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-28869.

URL Resource
https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts cve-icon cve-icon cve-icon
https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6 cve-icon cve-icon cve-icon cve-icon
https://github.com/traefik/traefik/releases/tag/v2.11.2 cve-icon cve-icon cve-icon
https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5 cve-icon cve-icon cve-icon
https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw cve-icon cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-28869 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-28869 cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact