CVE-2024-28869
Status: AnalyzedHigh (7.5)—
Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Base score: 7.5
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 1.05%
- Percentile among all scored CVEs: 63
- Score date: 10/7/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-755
References
- https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts
- https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6
- https://github.com/traefik/traefik/releases/tag/v2.11.2
- https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5
- https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw
- https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts
- https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6
- https://github.com/traefik/traefik/releases/tag/v2.11.2
- https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5
- https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw
Raw JSON (NVD)
Show
{
"id": "CVE-2024-28869",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-28869",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-06-18T18:26:38.989480Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "security-advisories@github.com",
"affectedData": [
{
"vendor": "traefik",
"product": "traefik",
"versions": [
{
"status": "affected",
"version": "< 2.11.2"
},
{
"status": "affected",
"version": ">= 3.0.0-rc1, < 3.0.0-rc5"
}
]
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"cpes": [
"cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*"
],
"vendor": "traefik",
"product": "traefik",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.11.2",
"versionType": "custom"
},
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "3.0.0-rc3"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2024-04-12T22:15:07.080",
"references": [
{
"url": "https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts",
"tags": [
"Product"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6",
"tags": [
"Patch"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/traefik/traefik/releases/tag/v2.11.2",
"tags": [
"Release Notes"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5",
"tags": [
"Release Notes"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts",
"tags": [
"Product"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/traefik/traefik/releases/tag/v2.11.2",
"tags": [
"Release Notes"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5",
"tags": [
"Release Notes"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"description": [
{
"lang": "en",
"value": "CWE-755"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the \"Content-length\" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.\n"
},
{
"lang": "es",
"value": "Traefik es un proxy inverso HTTP y un equilibrador de carga. En las versiones afectadas, enviar una solicitud GET a cualquier endpoint de Traefik con el encabezado de solicitud \"Longitud del contenido\" da como resultado un bloqueo indefinido con la configuración predeterminada. Los atacantes pueden aprovechar esta vulnerabilidad para inducir una denegación de servicio. Esta vulnerabilidad se ha solucionado en las versiones 2.11.2 y 3.0.0-rc5. Se recomienda a los usuarios que actualicen. Para las versiones afectadas, esta vulnerabilidad se puede mitigar configurando la opción readTimeout."
}
],
"lastModified": "2026-06-17T07:21:56.533",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "947FFF0A-54AD-407B-BACD-D065A58597C0",
"versionEndExcluding": "2.11.2"
},
{
"criteria": "cpe:2.3:a:traefik:traefik:3.0.0:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F6D7552B-336D-43F9-8D66-84EECA4956B2"
},
{
"criteria": "cpe:2.3:a:traefik:traefik:3.0.0:beta1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "376EAF9B-E994-4268-9704-0A45EA30270F"
},
{
"criteria": "cpe:2.3:a:traefik:traefik:3.0.0:beta2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F3D08335-C291-4623-B80C-3B14C4D1FA32"
},
{
"criteria": "cpe:2.3:a:traefik:traefik:3.0.0:beta3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "21033CEE-CEF5-4B0D-A565-4A6FC764AA6D"
},
{
"criteria": "cpe:2.3:a:traefik:traefik:3.0.0:beta4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4B5B7BC8-0BBF-48DC-86B1-FC3D7CB8D5AD"
},
{
"criteria": "cpe:2.3:a:traefik:traefik:3.0.0:beta5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E1AA1A9D-D6B3-40B9-A0D6-E01B08945590"
},
{
"criteria": "cpe:2.3:a:traefik:traefik:3.0.0:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1357EB9F-9789-40CE-B703-84EC39CF1E83"
},
{
"criteria": "cpe:2.3:a:traefik:traefik:3.0.0:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9694CC08-ABA4-46A0-B547-2FFF96D511BF"
},
{
"criteria": "cpe:2.3:a:traefik:traefik:3.0.0:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8E8706E8-24A7-4F07-8BB8-AD254D6430F0"
},
{
"criteria": "cpe:2.3:a:traefik:traefik:3.0.0:rc4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "16599024-F3E6-4F1E-A7C6-C3730F2EE48D"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security-advisories@github.com"
}