What is GHSA-4vwx-54mw-vqfw?

GHSA-4vwx-54mw-vqfw is a security advisory published by GitHub Security Advisories with High severity. Traefik vulnerable to denial of service with Content-length header

Which CVE IDs does GHSA-4vwx-54mw-vqfw cover?

GHSA-4vwx-54mw-vqfw covers the following CVE IDs: CVE-2024-28869. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4vwx-54mw-vqfw?

GHSA-4vwx-54mw-vqfw has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-4vwx-54mw-vqfw?

GHSA-4vwx-54mw-vqfw affects 3 products, including: go/github.com/traefik/traefik/v3:\u003e= 3.0.0-beta3, \u003c= 3.0.0-rc4; go/github.com/traefik/traefik/v2:\u003c= 2.11.1; go/github.com/traefik/traefik:\u003c= 2.11.1.

GHSA-4vwx-54mw-vqfwHighCVSS 7.5

Traefik vulnerable to denial of service with Content-length header

Vendor

GitHub Security Advisories

Published

April 12, 2024

Last Modified

April 15, 2024

🔗 CVE IDs covered (1)

CVE-2024-28869 →

📋 Description

There is a potential vulnerability in Traefik managing requests with Content-length and no body .

Sending a GET request to any Traefik endpoint with the Content-length request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service.

Patches

https://github.com/traefik/traefik/releases/tag/v2.11.2
https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5

Workarounds

For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.

For more information

If you have any questions or comments about this advisory, please open an issue.

🎯 Affected products3

go/github.com/traefik/traefik/v3:>= 3.0.0-beta3, <= 3.0.0-rc4
go/github.com/traefik/traefik/v2:<= 2.11.1
go/github.com/traefik/traefik:<= 2.11.1