CVE-2026-88878

Executive Summary

CVE-2026-88878 is a denial-of-service vulnerability in Traefik, an HTTP reverse proxy and load balancer, affecting versions v2.8.2 through v2.11.55 and v3.0.0 through v3.7.11. The flaw causes HTTP/3 entry point transport timeouts, specifically readTimeout (default 60s), to be ignored on the HTTP/3 request path, allowing an unauthenticated remote attacker to hold requests open indefinitely by trickling request body bytes. This resource exhaustion exhausts bounded backend connection pools, degrading or halting service availability on deployments with HTTP/3 enabled.

Technical Analysis

Traefik exposes HTTP/3 support on entry points when explicitly enabled. The vulnerability resides in how Traefik constructs its HTTP/3 server. In affected versions, the entryPoints.<name>.transport.respondingTimeouts settings — most notably readTimeout, which defaults to 60 seconds — are not enforced on the HTTP/3 request path.

The root cause is architectural: readTimeout is implemented as a deadline on the underlying TCP connection. HTTP/3 operates over QUIC, which is stream-oriented rather than connection-oriented for request/response semantics; a TCP-level deadline cannot be applied to a QUIC stream. Consequently, Traefik's HTTP/3 server is constructed without any timeout enforcement. This means a slow or trickling client on an HTTP/3 entry point is never disconnected by the read timeout.

The regression was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that previously carried these timeouts. Since that point, the timeout values configured for transport respondingTimeouts ceased to apply to HTTP/3 traffic. The issue is classified as CWE-770 (Allocation of Resources Without Limits or Throttling).

The attack surface is any Traefik entry point on which HTTP/3 is enabled and reachable from untrusted networks (typically UDP/443 for QUIC). No authentication is required. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, yielding a base score of 5.3 — a network-reachable, low-complexity availability impact.

Exploitation Scenarios

No public proof-of-concept or exploit code is available at the time of writing; the attack chain below is inferred from the vulnerability class (resource exhaustion via missing timeouts) and the vendor description.

1. Reconnaissance / target identification. An attacker scans for Traefik instances with HTTP/3 exposed. This can be accomplished by probing UDP ports (commonly 443) using QUIC handshakes, or by identifying Traefik via HTTP response headers (e.g., Server: Traefik) and then testing HTTP/3 availability via the Alt-Svc header advertised by the HTTP/1.1 or HTTP/2 listener. Only entry points with HTTP/3 explicitly enabled are vulnerable.

2. Triggering the flaw. The attacker initiates an HTTP/3 request to a vulnerable entry point and opens a request body without completing it. Using a QUIC client, the attacker sends request body bytes a few bytes at a time (a "trickle" or slowloris-style pattern) so that the request never completes and never times out. Because the readTimeout deadline is not applied to the QUIC stream, Traefik keeps the request and its associated upstream connection open indefinitely.

3. Payload/execution method. No malicious payload is required — the attack abuses legitimate protocol behavior. The attacker repeatedly opens such stalled HTTP/3 requests, each consuming one upstream connection from Traefik's bounded backend connection pool.

4. Post-exploitation impact. As stalled requests accumulate, they consume the finite pool of upstream connections. Once the pool is exhausted, legitimate requests cannot obtain an upstream connection, resulting in denial of service for services proxied through the affected entry point. The attack is unauthenticated and low-complexity, and it requires only sustained slow HTTP/3 traffic rather than high request volume.

Impact Assessment

Successful exploitation results in a denial-of-service condition on the affected Traefik entry point. The CVSS 3.1 subscores reflect: network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), no integrity impact (I:N), and low availability impact (A:L). The base score is 5.3 (Medium).

Business impact centers on availability: services fronted by Traefik with HTTP/3 enabled can become unavailable to legitimate users. Blast radius is limited to the specific entry point(s) with HTTP/3 enabled and the upstream services behind them, but any organization relying on such entry points for production traffic faces service disruption. Because the attack is unauthenticated and requires only a modest number of slow, long-lived requests, it is within reach of low-sophistication actors. The absence of public exploit code and of CISA KEV listing suggests no confirmed exploitation in the wild at the time of writing, but the vulnerability is trivially reproducible against unpatched, internet-exposed HTTP/3 entry points.

Detection Guidance

Sigma Rule

title: Potential Traefik HTTP/3 Slow Request DoS (CVE-2026-88878)
id: 8a3f1c2e-6b7d-4e9a-9f10-2c5d7e8a1b34
status: experimental
description: Detects sustained long-lived HTTP/3 or QUIC requests that may indicate abuse of missing readTimeout on Traefik HTTP/3 entry points.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-88878
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
logsource:
  category: webserver
  product: traefik
detection:
  selection_proto:
    network_protocol: 'HTTP/3'
  selection_duration:
    duration|gte: 60
  selection_status:
    status: 'in_progress'
  condition: selection_proto and (selection_duration or selection_status)
falsepositives:
  - Legitimate long-polling or streaming endpoints
  - Large legitimate file uploads over HTTP/3
level: medium

YARA Rule

rule CVE_2026_88878_Traefik_HTTP3_No_Timeout
{
    meta:
        description = "Detects Traefik builds referencing HTTP/3 server construction potentially lacking readTimeout (CVE-2026-88878)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-88878"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $traefik = "traefik" ascii nocase
        $http3   = "http3" ascii nocase
        $quic    = "quic-go" ascii nocase
        $timeout = "ReadTimeout" ascii
        $entry   = "entryPoints" ascii

    condition:
        uint32(0) == 0x464C457F and
        $traefik and $http3 and $quic and
        not $timeout and $entry
}

Suricata IDS Rule

alert udp any any -> any 443 (msg:"CVE-2026-88878 Traefik HTTP/3 Slow Request DoS Attempt"; flow:to_server; dsize:<64; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-dos; reference:cve,2026-88878; sid:202688878; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [network where network.transport == "udp" and destination.port == 443 and network.protocol == "http3"]
  [network where network.transport == "udp" and destination.port == 443 and network.protocol == "http3" and network.bytes < 64]

Splunk SPL Query

index=proxy sourcetype=traefik http3=true status=in_progress
| stats count as open_requests, dc(src_ip) as clients by entrypoint, backend_pool
| where open_requests > 50
| eval severity=if(open_requests > 200, "high", "medium")

Alternative for network telemetry:

index=netflow dest_port=443 proto=udp
| bin _time span=1m
| stats sum(bytes) as total_bytes, dc(src) as srcs by dest, _time
| where total_bytes < 1000 and srcs > 10

Wazuh OSSEC Rule

<group name="traefik,web,attack,">
  <rule id="100778" level="10">
    <decoded_as>json</decoded_as>
    <field name="proto">HTTP/3</field>
    <field name="duration">\.</field>
    <regex>^([6-9][0-9]|[1-9][0-9]{2,})$</regex>
    <description>CVE-2026-88878: Possible Traefik HTTP/3 slow request DoS - long-lived HTTP/3 request detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Note: the NVD description states the issue is fixed in v2.11.56 and v3.7.12, but no patch evidence was retrieved from tracked sources at the time of this report; verify the current vendor release status before relying on this claim.

1. Immediate mitigations:

   • Disable HTTP/3 on any entry point exposed to untrusted networks until the affected version can be upgraded. If HTTP/3 is not required, this fully removes the attack surface.
   • If HTTP/3 must remain enabled, restrict UDP access (typically port 443) to trusted networks or place the entry point behind infrastructure that enforces connection/stream timeouts.
   • Monitor upstream connection pool utilization and alert on connection exhaustion.

2. Patch/upgrade steps:

   • Upgrade to Traefik v2.11.56 or v3.7.12 (per the NVD description), which are the stated fixed releases. Confirm availability from the vendor before deployment.
   • Validate the upgrade in a staging environment with HTTP/3 enabled and verify request timeout enforcement.

3. Long-term hardening:

   • Maintain an inventory of entry points and explicitly document which protocols (including HTTP/3) are enabled on each.
   • Apply defense-in-depth network controls (rate limiting, connection limits at the load balancer or front-end WAF) so that a single missing application-layer timeout cannot exhaust backend resources.
   • Subscribe to Traefik security advisories and track release notes for changes to quic-go/HTTP/3 handling, and monitor CISA KEV for any future exploitation evidence.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-88878
• Traefik security advisories / release notes (vendor): https://github.com/traefik/traefik/releases
• Traefik documentation on entryPoints transport respondingTimeouts: https://doc.traefik.io/traefik/routing/entrypoints/
• CWE-770 (Allocation of Resources Without Limits or Throttling): https://cwe.mitre.org/data/definitions/770.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/

No known threat actor campaigns or exploit-in-the-wild evidence were identified for CVE-2026-88878 at the time of writing. The vulnerability is not listed in CISA KEV, no public PoC or exploit code is available, and no Nuclei template was identified.