CVE-2026-88012

Executive Summary

CVE-2026-88012 is a resource-consumption vulnerability (CWE-770) in Traefik, an open-source HTTP reverse proxy and load balancer. From version 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints fail to enforce the configured entryPoints.*.transport.respondingTimeouts.readTimeout because that timeout is applied only at the TCP connection layer, while the HTTP/3 server has no corresponding QUIC stream deadline. This allows an unauthenticated remote client to hold requests and upstream connections open indefinitely via a slow, trickling request body. The result is exhaustion of backend connection pools and a limited availability impact (CVSS 5.3, A:L), with no confidentiality or integrity impact.

Technical Analysis

Traefik supports HTTP/3, which runs over QUIC rather than TCP. Traefik's read timeout configuration (entryPoints.*.transport.respondingTimeouts.readTimeout) is enforced on the underlying TCP connection. In an HTTP/3 context, the transport is QUIC, and the HTTP/3 server has no equivalent stream-level deadline mapped to readTimeout. Consequently, the read timeout is effectively bypassed for HTTP/3 traffic in affected versions.

The vulnerability class is uncontrolled resource consumption (CWE-770), specifically a slow-request / resource-exhaustion denial-of-service condition. Because the timeout is not applied to the QUIC stream, an unauthenticated client can send a request body slowly and indefinitely ("trickling" data), keeping the request and an associated upstream connection open for an arbitrarily long period. Traefik acts as a reverse proxy; each held request consumes a connection toward the backend. Where backends have bounded connection pools, sustained trickling from one or more clients can exhaust those pools, degrading or denying service to legitimate traffic.

Key technical facts derived strictly from the NVD description:

• The missing control is entryPoints.*.transport.respondingTimeouts.readTimeout applied to HTTP/3.
• Root cause: the timeout is enforced on a TCP connection; the HTTP/3 server has no corresponding QUIC stream deadline.
• Attack vector: unauthenticated, network-reachable, low complexity (AV:N/AC:L/PR:N/UI:N).
• Impact: availability only, limited (A:L). No scope change (S:U).
• Affected range: 2.8.2 through 2.11.55 and 3.x through 3.7.11; fixed in 2.11.56 and 3.7.12.

No public proof-of-concept, exploit code, or Nuclei template was identified. The precise HTTP/3 frame-level behavior of the trickle is inferred from the vulnerability class; no specific code paths, function names, or parameters beyond those in the NVD text should be assumed.

Exploitation Scenarios

1. Reconnaissance / target identification: An attacker identifies internet-facing Traefik instances advertising HTTP/3 (typically over UDP/443 via the Alt-Svc header or direct QUIC probes). Shodan-style fingerprinting (http.title:"Traefik", product:"Traefik") can enumerate candidate targets.
2. Triggering the flaw class: The attacker opens an HTTP/3 (QUIC) connection to a vulnerable entrypoint and initiates a request with a body. Because the HTTP/3 server lacks a stream deadline corresponding to readTimeout, the attacker sends body bytes slowly and continuously, preventing the request from completing and preventing timeout-based teardown.
3. Payload / execution at class level: No malicious payload is required — this is a resource-exhaustion attack, not code execution. The "payload" is a deliberately slow, endless HTTP/3 request body. The attacker repeats this across many streams/connections to maximize held requests.
4. Post-exploitation impact: Each held request occupies an upstream connection. When backends have bounded connection pools, the attacker exhausts them, causing legitimate requests to be queued, delayed, or refused. Impact is availability-only (A:L); no data exfiltration or modification is expected. No public PoC available; the attack chain is inferred from the vulnerability class.

Impact Assessment

Business impact centers on availability degradation of services fronted by Traefik over HTTP/3. Because the attack is unauthenticated (PR:N), network-reachable (AV:N), and low-complexity (AC:L), it is trivially repeatable. The CVSS 5.3 reflects a limited availability impact (A:L) with no confidentiality (C:N) or integrity (I:N) impact and no scope change (S:U), i.e., the effects remain within the vulnerable component's security authority. Blast radius includes any deployment that (a) runs an affected Traefik version, (b) exposes HTTP/3 entrypoints to untrusted networks, and (c) fronts backends with bounded connection pools. Aggregate deployments that pool many services behind a single Traefik instance are at higher operational risk because a connection-pool exhaustion event can affect multiple downstream services simultaneously. Single-tenant, low-traffic, or HTTP/2-only (no HTTP/3) deployments are largely unaffected.

Detection Guidance

Sigma Rule

title: Traefik HTTP/3 Slow Request Body Resource Exhaustion (CVE-2026-88012)
id: 8f1c2a44-7b3e-4c9d-9a12-traefik88012
status: experimental
description: Detects long-lived HTTP/3 requests to a Traefik entrypoint with a trickling request body, consistent with readTimeout bypass leading to connection pool exhaustion.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-88012
author: valtersit.com
logsource:
  category: webserver
  product: traefik
detection:
  selection_timeout:
    proto: 'HTTP/3'
    duration|gte: 120
  selection_slow:
    bytes_sent|lt: 1024
  condition: selection_timeout and selection_slow
falsepositives:
  - Legitimate large uploads over slow mobile links
  - Long-poll or streaming APIs with intentional slow consumers
level: medium
tags:
  - attack.t1190
  - cve.2026.88012

YARA Rule

rule CVE_2026_88012_Traefik_HTTP3_ReadTimeout_Bypass
{
    meta:
        author = "valtersit.com"
        description = "Flags Traefik configuration/log artifacts referencing HTTP/3 entrypoints and respondingTimeouts.readTimeout, relevant to CVE-2026-88012"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-88012"
        date = "2026-01-01"
    strings:
        $h3 = "http3" nocase
        $timeout = "respondingTimeouts" nocase
        $rt = "readTimeout" nocase
        $entry = "entryPoints" nocase
    condition:
        filesize < 5MB and $timeout and $rt and ($h3 or $entry)
}

Suricata IDS Rule

alert quic any any -> any any (msg:"CVE-2026-88012 Traefik HTTP/3 ReadTimeout Bypass - Slow Trickle Request"; flow:established,to_server; dsize:<100; threshold:type both, track by_src, count 20, seconds 120; classtype:attempted-dos; reference:cve,2026-88012; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-88012; sid:9000012; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=2m
  [network where network.transport == "quic" and http.version == "HTTP/3" and destination.port == 443]
  [network where network.transport == "quic" and destination.bytes < 512]

Splunk SPL Query

index=proxy OR index=traefik proto="HTTP/3"
| stats count, sum(bytes) as total_bytes, avg(duration) as avg_dur by src_ip, dest
| where avg_dur > 120 AND total_bytes < count * 1024
| sort - avg_dur
| table src_ip, dest, count, total_bytes, avg_dur

Wazuh OSSEC Rule

<group name="traefik,cve-2026-88012,">
  <rule id="880120" level="10">
    <decoded_as>json</decoded_as>
    <field name="proto">HTTP/3</field>
    <field name="duration" type="pcre2">^[1-9][0-9]{2,}$</field>
    <field name="bytes_sent" type="pcre2">^\d{1,3}$</field>
    <description>CVE-2026-88012: Possible Traefik HTTP/3 slow-request resource exhaustion (readTimeout bypass)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor-fix confirmation, OSV package data, or workaround confirmation was supplied; the fixed versions in the NVD description (2.11.56, 3.7.12) must be validated against the vendor's release notes before relying on them.

1. Immediate mitigations:

   • Disable HTTP/3 on untrusted-facing entrypoints where feasible; force HTTP/2 or HTTP/1.1 until an upgrade is validated, since the missing QUIC stream deadline does not apply to those transports.
   • Enforce request-body size and overall request duration limits at an upstream layer (edge proxy, WAF, or load balancer) that applies to QUIC/UDP traffic, since Traefik's TCP-layer readTimeout does not constrain HTTP/3.
   • Rate-limit new connections and concurrent streams per source IP on HTTP/3 listeners.
   • Reduce backend connection-pool sizes so exhaustion is detected early and monitored; alert on pool saturation.

2. Patch / upgrade steps:

   • Upgrade to Traefik 2.11.56 or 3.7.12 per the NVD description.
   • Verify version with the Traefik dashboard or binary version output after upgrade.
   • Because patch confidence is 0/4, confirm the fix in a staging environment by reproducing the trickle scenario before broad rollout.

3. Long-term hardening:

   • Standardize timeout and body-size enforcement at the edge and re-validate coverage across all supported protocols (HTTP/1.1, HTTP/2, HTTP/3).
   • Monitor backend connection pools and emit alerts on sustained saturation.
   • Subscribe to Traefik security advisories and CVE feeds to catch follow-up fixes.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-88012
• Traefik security advisories: https://github.com/traefik/traefik/security/advisories
• Traefik documentation (entryPoints / respondingTimeouts): https://doc.traefik.io/traefik/
• CWE-770 Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/770.html
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (not listed as of this report)

No threat actor campaigns or exploit-in-the-wild evidence were identified in the provided data; EPSS has not yet scored this CVE.