Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.
References
Configurations
No configuration.
History
15 Apr 2024, 13:15
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
12 Apr 2024, 22:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-04-12 22:15
Updated : 2024-04-15 13:15
NVD link : CVE-2024-28869
Mitre link : CVE-2024-28869
CVE.ORG link : CVE-2024-28869
JSON object : View
Products Affected
No product.
CWE
CWE-755
Improper Handling of Exceptional Conditions