Skip to content
Fencer Vulns
high 7.5

CVE-2024-28869 json

Possible denial of service vulnerability with Content-length header in Traefik

published 2024-04-12 2 y ago modified 2026-08-07 3 mo ago also EUVD-2024-1095 , GHSA-4vwx-54mw-vqfw , GO-2024-2722

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 64%
public exploits
0
none known

Summary

Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.

Patch / fix

  • go github.com/traefik/traefik/v3 3.0.0-rc5
  • go github.com/traefik/traefik/v2 2.11.2
  • go github.com/traefik/traefik 2.11.2
  • traefik traefik 2.11.2
  • traefik2 openSUSE Tumbleweed 2.11.5-1.1
  • traefik openSUSE Tumbleweed 2.11.2-1.1

opensuse advisories openSUSE-SU-2024:14076-1openSUSE-SU-2024:13927-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-28869 updated cvss 7.5

traefik: denial of service

  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.23 devspaces 3.23-1756504388
    fixed: vendor fix RHSA-2025:15847
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.23 devspaces 3.23-1756506343, devspaces 3.23-1756507311, devspaces 3.23-1756509551, devspaces 3.23-1756753588, devspaces 3.23-1756828766, devspaces 3.23-1757017659, +8 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.05% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/traefik/traefik/v3
>=3.0.0-beta3, <3.0.0-rc5
3.0.0-rc5
go github.com/traefik/traefik/v2
<2.11.2
2.11.2
go github.com/traefik/traefik
<2.11.2
all versions
2.11.2

Affected products

  • traefik traefik

Classification

Weakness
  • CWE-755 Improper Handling of Exceptional Conditions
  • CWE-404 Improper Resource Shutdown or Release

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.