https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 30 Oct 2026 18:29:43 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-88878 <p>Traefik is an HTTP reverse proxy and load balancer. In versions &gt;= v2.8.2 through &lt;= v2.11.55 and &gt;= v3.0.0 through &lt;= v3.7.11, the entryPoints.&lt;name&gt;.transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying TCP connection, which cannot be applied to a QUIC stream, and Traefik&#39;s HTTP/3 server is constructed without any timeout. As a result, on entry points with HTTP/3 enabled, an unauthenticated remote client that trickles request body bytes can hold a request open indefinitely and, with it, one upstream connection per request, exhausting bounded backend connection pools and causing denial of service. The issue was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that carried these timeouts. Fixed in v2.11.56 and v3.7.12.</p> <p>Traefik is an HTTP reverse proxy and load balancer. In versions &gt;= v2.8.2 through &lt;= v2.11.55 and &gt;= v3.0.0 through &lt;= v3.7.11, the entryPoints.&lt;name&gt;.transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying TCP connection, which cannot be applied to a QUIC stream, and Traefik&#39;s HTTP/3 server is constructed without any timeout. As a result, on entry points with HTTP/3 enabled, an unauthenticated remote client that trickles request body bytes can hold a request open indefinitely and, with it, one upstream connection per request, exhausting bounded backend connection pools and causing denial of service. The issue was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that carried these timeouts. Fixed in v2.11.56 and v3.7.12.</p> https://db.gcve.eu/vuln/fkie_cve-2026-88878 https://db.gcve.eu/vuln/ghsa-c9gw-2969-4fg3 <p>Traefik is an HTTP reverse proxy and load balancer. In versions &gt;= v2.8.2 through &lt;= v2.11.55 and &gt;= v3.0.0 through &lt;= v3.7.11, the entryPoints.&lt;name&gt;.transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying TCP connection, which cannot be applied to a QUIC stream, and Traefik&#39;s HTTP/3 server is constructed without any timeout. As a result, on entry points with HTTP/3 enabled, an unauthenticated remote client that trickles request body bytes can hold a request open indefinitely and, with it, one upstream connection per request, exhausting bounded backend connection pools and causing denial of service. The issue was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that carried these timeouts. Fixed in v2.11.56 and v3.7.12.</p> <p>Traefik is an HTTP reverse proxy and load balancer. In versions &gt;= v2.8.2 through &lt;= v2.11.55 and &gt;= v3.0.0 through &lt;= v3.7.11, the entryPoints.&lt;name&gt;.transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying TCP connection, which cannot be applied to a QUIC stream, and Traefik&#39;s HTTP/3 server is constructed without any timeout. As a result, on entry points with HTTP/3 enabled, an unauthenticated remote client that trickles request body bytes can hold a request open indefinitely and, with it, one upstream connection per request, exhausting bounded backend connection pools and causing denial of service. The issue was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that carried these timeouts. Fixed in v2.11.56 and v3.7.12.</p> https://db.gcve.eu/vuln/ghsa-c9gw-2969-4fg3 https://db.gcve.eu/vuln/rhsa-2026:90321 <p>zod: zod: Denial of service via unbounded array validation axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function bouncycastle: Bouncy Castle: Denial of Service via untrusted keystore length allocation undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcprov-jdk18on: org.bouncycastle/bc-fips: org.bouncycastle/bctls-fips: Bouncy Castle for Java: Denial of Service due to unbounded memory allocation io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction @fastify/static: @fastify/static: Information disclosure via route guard bypass org.eclipse.jetty/jetty-http: Jetty: HTTP request smuggling via crafted chunked requests undici: undici: Denial of Service via unrequested WebSocket subprotocol net/mail: golang: Go net/mail: Denial of Service via crafted email inputs github.com/open-teleme…</p> <p>zod: zod: Denial of service via unbounded array validation axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function bouncycastle: Bouncy Castle: Denial of Service via untrusted keystore length allocation undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcprov-jdk18on: org.bouncycastle/bc-fips: org.bouncycastle/bctls-fips: Bouncy Castle for Java: Denial of Service due to unbounded memory allocation io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction @fastify/static: @fastify/static: Information disclosure via route guard bypass org.eclipse.jetty/jetty-http: Jetty: HTTP request smuggling via crafted chunked requests undici: undici: Denial of Service via unrequested WebSocket subprotocol net/mail: golang: Go net/mail: Denial of Service via crafted email inputs github.com/open-teleme…</p> https://db.gcve.eu/vuln/rhsa-2026:90321