Vulnerability-Lookup

CVE-2024-28869 (GCVE-0-2024-28869)

Vulnerability from cvelistv5 – Published: 2024-04-12 21:08 – Updated: 2024-08-02 00:56

Title

Possible denial of service vulnerability with Content-length header in Traefik

Summary

Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-18 18:26 UTC

CWE

CWE-755 - Improper Handling of Exceptional Conditions

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/traefik/traefik/security/advis…	x_refsource_CONFIRM
https://github.com/traefik/traefik/commit/240b83b…	x_refsource_MISC
https://doc.traefik.io/traefik/routing/entrypoint…	x_refsource_MISC
https://github.com/traefik/traefik/releases/tag/v2.11.2	x_refsource_MISC
https://github.com/traefik/traefik/releases/tag/v…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version	CPE status
traefik	traefik	Affected: < 2.11.2 Affected: >= 3.0.0-rc1, < 3.0.0-rc5	guessed
traefik	traefik	Affected: 0 , < 2.11.2 (custom) Affected: 0 , ≤ 3.0.0-rc3 (custom) cpe:2.3:a:traefik:traefik::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "traefik",
            "vendor": "traefik",
            "versions": [
              {
                "lessThan": "2.11.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "3.0.0-rc3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-28869",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-18T18:26:38.989480Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-18T18:27:45.460Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:56:58.412Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw"
          },
          {
            "name": "https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6"
          },
          {
            "name": "https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts"
          },
          {
            "name": "https://github.com/traefik/traefik/releases/tag/v2.11.2",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/traefik/traefik/releases/tag/v2.11.2"
          },
          {
            "name": "https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "traefik",
          "vendor": "traefik",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.11.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0-rc1, \u003c 3.0.0-rc5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the \"Content-length\" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "CWE-755: Improper Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-12T21:08:36.288Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw"
        },
        {
          "name": "https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6"
        },
        {
          "name": "https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts"
        },
        {
          "name": "https://github.com/traefik/traefik/releases/tag/v2.11.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/traefik/traefik/releases/tag/v2.11.2"
        },
        {
          "name": "https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5"
        }
      ],
      "source": {
        "advisory": "GHSA-4vwx-54mw-vqfw",
        "discovery": "UNKNOWN"
      },
      "title": "Possible denial of service vulnerability with Content-length header in Traefik"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-28869",
    "datePublished": "2024-04-12T21:08:36.288Z",
    "dateReserved": "2024-03-11T22:45:07.688Z",
    "dateUpdated": "2024-08-02T00:56:58.412Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-28869",
      "date": "2026-09-22",
      "epss": "0.01046",
      "percentile": "0.62707"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the \"Content-length\" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.\n"
        },
        {
          "lang": "es",
          "value": "Traefik es un proxy inverso HTTP y un equilibrador de carga. En las versiones afectadas, enviar una solicitud GET a cualquier endpoint de Traefik con el encabezado de solicitud \"Longitud del contenido\" da como resultado un bloqueo indefinido con la configuraci\u00f3n predeterminada. Los atacantes pueden aprovechar esta vulnerabilidad para inducir una denegaci\u00f3n de servicio. Esta vulnerabilidad se ha solucionado en las versiones 2.11.2 y 3.0.0-rc5. Se recomienda a los usuarios que actualicen. Para las versiones afectadas, esta vulnerabilidad se puede mitigar configurando la opci\u00f3n readTimeout."
        }
      ],
      "id": "CVE-2024-28869",
      "lastModified": "2024-11-21T09:07:04.857",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 3.6,
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      },
      "published": "2024-04-12T22:15:07.080",
      "references": [
        {
          "source": "security-advisories@github.com",
          "url": "https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts"
        },
        {
          "source": "security-advisories@github.com",
          "url": "https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6"
        },
        {
          "source": "security-advisories@github.com",
          "url": "https://github.com/traefik/traefik/releases/tag/v2.11.2"
        },
        {
          "source": "security-advisories@github.com",
          "url": "https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5"
        },
        {
          "source": "security-advisories@github.com",
          "url": "https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://github.com/traefik/traefik/releases/tag/v2.11.2"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw"
        }
      ],
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-755"
            }
          ],
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "traefik",
                "vendor": "traefik",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.11.2"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 3.0.0-rc1, \u003c 3.0.0-rc5"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "traefik",
                "vendor": "traefik",
                "versions": [
                  {
                    "lessThan": "2.11.2",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "3.0.0-rc3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "947FFF0A-54AD-407B-BACD-D065A58597C0",
                    "versionEndExcluding": "2.11.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:traefik:traefik:3.0.0:-:*:*:*:*:*:*",
                    "matchCriteriaId": "F6D7552B-336D-43F9-8D66-84EECA4956B2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:traefik:traefik:3.0.0:beta1:*:*:*:*:*:*",
                    "matchCriteriaId": "376EAF9B-E994-4268-9704-0A45EA30270F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:traefik:traefik:3.0.0:beta2:*:*:*:*:*:*",
                    "matchCriteriaId": "F3D08335-C291-4623-B80C-3B14C4D1FA32",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:traefik:traefik:3.0.0:beta3:*:*:*:*:*:*",
                    "matchCriteriaId": "21033CEE-CEF5-4B0D-A565-4A6FC764AA6D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:traefik:traefik:3.0.0:beta4:*:*:*:*:*:*",
                    "matchCriteriaId": "4B5B7BC8-0BBF-48DC-86B1-FC3D7CB8D5AD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:traefik:traefik:3.0.0:beta5:*:*:*:*:*:*",
                    "matchCriteriaId": "E1AA1A9D-D6B3-40B9-A0D6-E01B08945590",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:traefik:traefik:3.0.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "1357EB9F-9789-40CE-B703-84EC39CF1E83",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:traefik:traefik:3.0.0:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "9694CC08-ABA4-46A0-B547-2FFF96D511BF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:traefik:traefik:3.0.0:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "8E8706E8-24A7-4F07-8BB8-AD254D6430F0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:traefik:traefik:3.0.0:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "16599024-F3E6-4F1E-A7C6-C3730F2EE48D",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the \"Content-length\" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.\n"
          },
          {
            "lang": "es",
            "value": "Traefik es un proxy inverso HTTP y un equilibrador de carga. En las versiones afectadas, enviar una solicitud GET a cualquier endpoint de Traefik con el encabezado de solicitud \"Longitud del contenido\" da como resultado un bloqueo indefinido con la configuraci\u00f3n predeterminada. Los atacantes pueden aprovechar esta vulnerabilidad para inducir una denegaci\u00f3n de servicio. Esta vulnerabilidad se ha solucionado en las versiones 2.11.2 y 3.0.0-rc5. Se recomienda a los usuarios que actualicen. Para las versiones afectadas, esta vulnerabilidad se puede mitigar configurando la opci\u00f3n readTimeout."
          }
        ],
        "id": "CVE-2024-28869",
        "lastModified": "2026-06-17T07:21:56.533",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-28869",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-18T18:26:38.989480Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-04-12T22:15:07.080",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Product"
            ],
            "url": "https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/traefik/traefik/releases/tag/v2.11.2"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Product"
            ],
            "url": "https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/traefik/traefik/releases/tag/v2.11.2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-755"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-21T17:22:05+00:00",
      "cve": "CVE-2024-28869",
      "id": "CVE-2024-28869",
      "initial_release_date": "2024-04-12T00:00:00+00:00",
      "product_status:fixed": "4",
      "product_status:known_not_affected": "50",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "traefik: denial of service",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-28869.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2025-03-15T05:16:03Z",
      "cve": "CVE-2024-28869",
      "id": "CVE-2024-28869",
      "initial_release_date": "2024-04-15T23:12:35Z",
      "product_status:recommended": "2",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-28869",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-28869.json",
      "version": "8"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T00:56:58.412Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "name": "https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw",
                "tags": [
                  "x_refsource_CONFIRM",
                  "x_transferred"
                ],
                "url": "https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw"
              },
              {
                "name": "https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6"
              },
              {
                "name": "https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts"
              },
              {
                "name": "https://github.com/traefik/traefik/releases/tag/v2.11.2",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/traefik/traefik/releases/tag/v2.11.2"
              },
              {
                "name": "https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "traefik",
                "vendor": "traefik",
                "versions": [
                  {
                    "lessThan": "2.11.2",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "3.0.0-rc3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-28869",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-06-18T18:26:38.989480Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-06-18T18:27:41.667Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "traefik",
              "vendor": "traefik",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.11.2"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 3.0.0-rc1, \u003c 3.0.0-rc5"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the \"Content-length\" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.\n"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-755",
                  "description": "CWE-755: Improper Handling of Exceptional Conditions",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-04-12T21:08:36.288Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw"
            },
            {
              "name": "https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6"
            },
            {
              "name": "https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts"
            },
            {
              "name": "https://github.com/traefik/traefik/releases/tag/v2.11.2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/traefik/traefik/releases/tag/v2.11.2"
            },
            {
              "name": "https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5"
            }
          ],
          "source": {
            "advisory": "GHSA-4vwx-54mw-vqfw",
            "discovery": "UNKNOWN"
          },
          "title": "Possible denial of service vulnerability with Content-length header in Traefik"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2024-28869",
        "datePublished": "2024-04-12T21:08:36.288Z",
        "dateReserved": "2024-03-11T22:45:07.688Z",
        "dateUpdated": "2024-08-02T00:56:58.412Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

BDU:2024-03542 (CVE-2024-28869)

Vulnerability from fstec – Published: 2024-05-07 – Updated: 2024-05-07 – View on bdu.fstec.ru Fixed

Title

Уязвимость обратного прокси сервера Containous Traefik, связанная с недостаточной обработкой исключительных состояний, позволяющая нарушителю вызвать отказ в обслуживании

Summary

Уязвимость обратного прокси сервера Containous Traefik связана с недостаточной обработкой исключительных состояний при обработке заголовков Content-Length в результате некорректно заданного параметра продолжительности чтения входящих запросов. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании

Severity

7.8 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:N/I:N/A:C

7.5 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Class

Architecture vulnerability

Status

Confirmed by the vendor

Exploitation

Timing and state manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-755 - Недостаточная обработка исключительных состояний

Aliases

CVE-2024-28869

References

6 references

URL
https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts
https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6
https://github.com/traefik/traefik/releases/tag/v2.11.2
https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5
https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw
https://vuldb.com/?id.260583

Impacted products

1 product from 1 vendor

Vendors

Containous

Products

Traefik

Versions

до 2.11.0 включительно (Traefik), от 3.0.0 до 3.0.0-rc3 включительно (Traefik)

Product types

Network software

Mitigations

Использование рекомендаций: https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6 https://github.com/traefik/traefik/releases/tag/v2.11.2 https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5 Компенсирующие меры: При невозможности установки обновлений рекомендуется настроить параметр продолжительности чтения входящих запросов - readTimeout. Более подробное описание доступно по ссылке: https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Containous",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 2.11.0 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Traefik), \u043e\u0442 3.0.0 \u0434\u043e 3.0.0-rc3 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Traefik)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw\nhttps://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6\nhttps://github.com/traefik/traefik/releases/tag/v2.11.2 \nhttps://github.com/traefik/traefik/releases/tag/v3.0.0-rc5\n\n\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n\u041f\u0440\u0438 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0447\u0442\u0435\u043d\u0438\u044f \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 - readTimeout. \n\u0411\u043e\u043b\u0435\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u043f\u043e \u0441\u0441\u044b\u043b\u043a\u0435:\nhttps://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "11.03.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "07.05.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "07.05.2024",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2024-03542",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2024-28869",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Traefik",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u043a\u0441\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Containous Traefik, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0430\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0439 (CWE-755)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u043a\u0441\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Containous Traefik \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0439 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 Content-Length \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u0437\u0430\u0434\u0430\u043d\u043d\u043e\u0433\u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0447\u0442\u0435\u043d\u0438\u044f \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u043e\u043a\u0430\u043c\u0438 \u0438 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435\u043c",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts \nhttps://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6 \nhttps://github.com/traefik/traefik/releases/tag/v2.11.2 \nhttps://github.com/traefik/traefik/releases/tag/v3.0.0-rc5 \nhttps://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw\nhttps://vuldb.com/?id.260583",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-755",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)"
}

FKIE_CVE-2024-28869

Vulnerability from fkie_nvd - Published: 2024-04-12 22:15 - Updated: 2026-06-17 07:21

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts	Product
security-advisories@github.com	https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6	Patch
security-advisories@github.com	https://github.com/traefik/traefik/releases/tag/v2.11.2	Release Notes
security-advisories@github.com	https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5	Release Notes
security-advisories@github.com	https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts	Product
af854a3a-2127-422b-91ae-364da2661108	https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/traefik/traefik/releases/tag/v2.11.2	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw	Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
traefik	traefik	*
traefik	traefik	3.0.0
traefik	traefik	3.0.0
traefik	traefik	3.0.0
traefik	traefik	3.0.0
traefik	traefik	3.0.0
traefik	traefik	3.0.0
traefik	traefik	3.0.0
traefik	traefik	3.0.0
traefik	traefik	3.0.0
traefik	traefik	3.0.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "traefik",
          "vendor": "traefik",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.11.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0-rc1, \u003c 3.0.0-rc5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "traefik",
          "vendor": "traefik",
          "versions": [
            {
              "lessThan": "2.11.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.0.0-rc3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "947FFF0A-54AD-407B-BACD-D065A58597C0",
              "versionEndExcluding": "2.11.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:3.0.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "F6D7552B-336D-43F9-8D66-84EECA4956B2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:3.0.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "376EAF9B-E994-4268-9704-0A45EA30270F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:3.0.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "F3D08335-C291-4623-B80C-3B14C4D1FA32",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:3.0.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "21033CEE-CEF5-4B0D-A565-4A6FC764AA6D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:3.0.0:beta4:*:*:*:*:*:*",
              "matchCriteriaId": "4B5B7BC8-0BBF-48DC-86B1-FC3D7CB8D5AD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:3.0.0:beta5:*:*:*:*:*:*",
              "matchCriteriaId": "E1AA1A9D-D6B3-40B9-A0D6-E01B08945590",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:3.0.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "1357EB9F-9789-40CE-B703-84EC39CF1E83",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:3.0.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "9694CC08-ABA4-46A0-B547-2FFF96D511BF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:3.0.0:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "8E8706E8-24A7-4F07-8BB8-AD254D6430F0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:3.0.0:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "16599024-F3E6-4F1E-A7C6-C3730F2EE48D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the \"Content-length\" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.\n"
    },
    {
      "lang": "es",
      "value": "Traefik es un proxy inverso HTTP y un equilibrador de carga. En las versiones afectadas, enviar una solicitud GET a cualquier endpoint de Traefik con el encabezado de solicitud \"Longitud del contenido\" da como resultado un bloqueo indefinido con la configuraci\u00f3n predeterminada. Los atacantes pueden aprovechar esta vulnerabilidad para inducir una denegaci\u00f3n de servicio. Esta vulnerabilidad se ha solucionado en las versiones 2.11.2 y 3.0.0-rc5. Se recomienda a los usuarios que actualicen. Para las versiones afectadas, esta vulnerabilidad se puede mitigar configurando la opci\u00f3n readTimeout."
    }
  ],
  "id": "CVE-2024-28869",
  "lastModified": "2026-06-17T07:21:56.533",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-28869",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-06-18T18:26:38.989480Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-04-12T22:15:07.080",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product"
      ],
      "url": "https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/traefik/traefik/releases/tag/v2.11.2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product"
      ],
      "url": "https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/traefik/traefik/releases/tag/v2.11.2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-755"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-4VWX-54MW-VQFW

Vulnerability from github – Published: 2024-04-12 17:05 – Updated: 2024-04-15 19:41

Summary

Traefik vulnerable to denial of service with Content-length header

Details

There is a potential vulnerability in Traefik managing requests with Content-length and no body .

Sending a GET request to any Traefik endpoint with the Content-length request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service.

Patches

https://github.com/traefik/traefik/releases/tag/v2.11.2
https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5

Workarounds

For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.

For more information

If you have any questions or comments about this advisory, please open an issue.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.0.0-rc4"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0-beta3"
            },
            {
              "fixed": "3.0.0-rc5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.11.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.11.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-28869"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-404",
      "CWE-755"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-12T17:05:13Z",
    "nvd_published_at": "2024-04-12T22:15:07Z",
    "severity": "HIGH"
  },
  "details": "There is a potential vulnerability in Traefik managing requests with `Content-length` and no `body` .\n\nSending a `GET` request to any Traefik endpoint with the `Content-length` request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.2\n- https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5\n\n## Workarounds\n\nFor affected versions, this vulnerability can be mitigated by configuring the [readTimeout](https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts) option.\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).",
  "id": "GHSA-4vwx-54mw-vqfw",
  "modified": "2024-04-15T19:41:13Z",
  "published": "2024-04-12T17:05:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28869"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6"
    },
    {
      "type": "WEB",
      "url": "https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/traefik/traefik"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v2.11.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Traefik vulnerable to denial of service with Content-length header"
}

GSD-2024-28869

Vulnerability from gsd - Updated: 2024-04-02 05:02

Details

Aliases

CVE-2024-28869

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-28869"
      ],
      "details": "Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the \"Content-length\" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.\n",
      "id": "GSD-2024-28869",
      "modified": "2024-04-02T05:02:55.837328Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2024-28869",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "traefik",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "\u003c 2.11.2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 3.0.0-rc1, \u003c 3.0.0-rc5"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "traefik"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the \"Content-length\" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.\n"
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-755",
                "lang": "eng",
                "value": "CWE-755: Improper Handling of Exceptional Conditions"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw",
            "refsource": "MISC",
            "url": "https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw"
          },
          {
            "name": "https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6",
            "refsource": "MISC",
            "url": "https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6"
          },
          {
            "name": "https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts",
            "refsource": "MISC",
            "url": "https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts"
          },
          {
            "name": "https://github.com/traefik/traefik/releases/tag/v2.11.2",
            "refsource": "MISC",
            "url": "https://github.com/traefik/traefik/releases/tag/v2.11.2"
          },
          {
            "name": "https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5",
            "refsource": "MISC",
            "url": "https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-4vwx-54mw-vqfw",
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the \"Content-length\" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.\n"
          },
          {
            "lang": "es",
            "value": "Traefik es un proxy inverso HTTP y un equilibrador de carga. En las versiones afectadas, enviar una solicitud GET a cualquier endpoint de Traefik con el encabezado de solicitud \"Longitud del contenido\" da como resultado un bloqueo indefinido con la configuraci\u00f3n predeterminada. Los atacantes pueden aprovechar esta vulnerabilidad para inducir una denegaci\u00f3n de servicio. Esta vulnerabilidad se ha solucionado en las versiones 2.11.2 y 3.0.0-rc5. Se recomienda a los usuarios que actualicen. Para las versiones afectadas, esta vulnerabilidad se puede mitigar configurando la opci\u00f3n readTimeout."
          }
        ],
        "id": "CVE-2024-28869",
        "lastModified": "2024-04-15T13:15:31.997",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-04-12T22:15:07.080",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/traefik/traefik/releases/tag/v2.11.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-755"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

OPENSUSE-SU-2024:13927-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2026-09-20 21:10

Summary

traefik-2.11.2-1.1 on GA media

Severity

Moderate

Scope

2 vulnerabilities in this advisory, including CVE-2024-28869.

CVE-2024-28869

Recommended: 4 products

Open the full advisory

OPENSUSE-SU-2024:14076-1

Vulnerability from csaf_opensuse - Published: 2024-06-24 00:00 - Updated: 2026-09-20 21:13

Summary

traefik2-2.11.5-1.1 on GA media

Severity

Moderate

Scope

15 vulnerabilities in this advisory, including CVE-2024-28869.

CVE-2024-28869

Recommended: 4 products

Open the full advisory

RHSA-2025:15847

Vulnerability from csaf_redhat - Published: 2025-09-15 16:27 - Updated: 2026-09-21 17:04

Summary

Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.23.0 Release.

Severity

Important

Scope

12 vulnerabilities in this advisory, including CVE-2024-28869.

CVE-2024-28869

An improper handling of exceptional conditions vulnerability was found in Traefik. In affected versions, sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default configuration, resulting in a denial of service.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 4 products Known not affected: 50 products

https://access.redhat.com/errata/RHSA-2025:15847

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-28869 (GCVE-0-2024-28869)

BDU:2024-03542 (CVE-2024-28869)

FKIE_CVE-2024-28869

GHSA-4VWX-54MW-VQFW

Patches

Workarounds

For more information

GSD-2024-28869

OPENSUSE-SU-2024:13927-1

OPENSUSE-SU-2024:14076-1

RHSA-2025:15847

Tags

Sightings

Nomenclature

Related by attack behaviour