CVE-2024-28869: Traefik HTTP Proxy DoS Vulnerability

CVE-2024-28869 Overview

CVE-2024-28869 is a denial of service vulnerability in Traefik, an open-source HTTP reverse proxy and load balancer. In affected versions, sending a GET request to any Traefik endpoint with a Content-length request header causes the server to hang indefinitely under the default configuration. Attackers can abuse this behavior to exhaust connection handlers and induce a denial of service against any internet-facing Traefik instance. The issue is tracked under [CWE-755] (Improper Handling of Exceptional Conditions). Traefik resolved the flaw in versions 2.11.2 and 3.0.0-rc5.

Critical Impact
Unauthenticated remote attackers can trigger indefinite request hangs against Traefik endpoints, leading to denial of service of downstream applications routed through the proxy.

Affected Products

Traefik versions prior to 2.11.2
Traefik 3.0.0 release candidates rc1 through rc4
Traefik 3.0.0 beta releases beta1 through beta5

Discovery Timeline

2024-04-12 - CVE-2024-28869 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28869

Vulnerability Analysis

The vulnerability is a denial of service condition triggered by malformed HTTP request handling. A GET request that includes a Content-length header causes Traefik to wait indefinitely for a request body that never arrives. The default Traefik configuration does not enforce a readTimeout, so the connection remains open until the client disconnects. Each hanging request consumes a goroutine and a network connection, allowing a low-volume attacker to exhaust available resources. Because the attack vector is unauthenticated network access to any routed endpoint, it can be issued by any client capable of opening a TCP connection to the proxy. The EPSS score is approximately 1.046% at the 59.7 percentile.

Root Cause

The root cause is improper handling of an exceptional input condition [CWE-755]. Traefik accepts the Content-length header on GET requests and enters a read state for a body, but the default entryPoint configuration does not bound the read operation with a timeout. The server therefore blocks indefinitely waiting for bytes that may never be sent.

Attack Vector

An unauthenticated remote attacker sends crafted GET requests with a Content-length header to any Traefik endpoint. Each request occupies server resources until the underlying connection is forcibly closed. Repeating this pattern across multiple sockets quickly saturates the proxy and denies service to legitimate traffic. No code examples are required to reproduce the condition; the issue is purely a missing timeout in the default entryPoint configuration. See the GitHub Security Advisory GHSA-4vwx-54mw-vqfw for the maintainer-confirmed technical description.

Detection Methods for CVE-2024-28869

Indicators of Compromise

GET requests arriving at Traefik entryPoints that include a Content-length header, particularly with non-zero values.
Long-lived inbound HTTP connections to Traefik without a corresponding response in proxy access logs.
Sudden growth in active goroutines, open file descriptors, or established TCP connections on the Traefik host.

Detection Strategies

Inspect HTTP access logs and reverse proxy metrics for GET requests carrying a Content-length header from a small set of source IP addresses.
Alert on Traefik request duration metrics that exceed expected service latency or never return a status code.
Correlate connection-state telemetry from the host with upstream backend health to identify proxy-layer stalls.

Monitoring Recommendations

Track Traefik Prometheus metrics such as traefik_entrypoint_open_connections and request duration histograms for anomalous spikes.
Monitor host-level connection counts and goroutine counts on Traefik nodes for sustained growth.
Log and review HTTP headers at the network edge to flag GET requests that improperly carry a Content-length value.

How to Mitigate CVE-2024-28869

Immediate Actions Required

Upgrade Traefik to version 2.11.2 or 3.0.0-rc5 or later, as published in the Traefik v2.11.2 release notes and Traefik v3.0.0-rc5 release notes.
For unpatched instances, configure a non-zero readTimeout on every entryPoint to bound the time the proxy waits for request bodies.
Restrict network exposure of Traefik administrative and routed endpoints to trusted sources where feasible.

Patch Information

The fix is included in Traefik 2.11.2 and 3.0.0-rc5. The upstream code change is recorded in Traefik commit 240b83b and described in GitHub Security Advisory GHSA-4vwx-54mw-vqfw. Operators running affected 2.x or 3.0.0 pre-release builds should plan an immediate upgrade.

Workarounds

Set an explicit readTimeout under entryPoints.<name>.transport.respondingTimeouts to abort hanging reads, as documented in the Traefik Responding Timeouts documentation.
Place a hardened upstream load balancer or WAF in front of Traefik to drop GET requests that include a Content-length header.
Apply rate limiting and per-source connection caps at the network edge to limit the impact of resource-exhaustion attempts.

bash

# Configuration example: enforce a readTimeout on the web entryPoint
entryPoints:
  web:
    address: ":80"
    transport:
      respondingTimeouts:
        readTimeout: "30s"
        writeTimeout: "30s"
        idleTimeout: "180s"