Veracode Vulnerability DatabaseVERACODE:46427Denial Of Service (DoS)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.0004 Low
EPSS
Percentile
15.5%
Traefik is vulnerable to a Denial Of Service (DoS). The vulnerability is due improper input validation when managing requests with a Content-length and no body. An attacker can send a GET request to any Traefik endpoint with the Content-length request header which results in an indefinite hang due to the default configuration.
References
doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts
github.com/advisories/GHSA-4vwx-54mw-vqfw
github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6
github.com/traefik/traefik/releases/tag/v2.11.2
github.com/traefik/traefik/releases/tag/v3.0.0-rc5
github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.0004 Low
EPSS
Percentile
15.5%