CVE-2026-88012: 
NixOS vulnerability analysis and mitigation

CVE-2026-88012 is a Denial of Service vulnerability in Traefik, an open-source HTTP reverse proxy and load balancer, caused by the failure to enforce readTimeout on HTTP/3 entrypoints. Affected versions span from v2.8.2 through v2.11.55 and v3.0.0 through v3.7.11; versions prior to v2.8.2 are not affected. The vulnerability was disclosed on September 10, 2026, with patches released on August 26, 2026 as v2.11.56 and v3.7.12. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): when Traefik's HTTP/3 server (http3.Server) was constructed in pkg/server/server_entrypoint_tcp_http3.go, it inherited the HTTPS handler but none of its timeout settings. The readTimeout configuration is implemented as a TCP connection deadline (SetReadDeadline) in the TCP entrypoint code, but this mechanism cannot reach a QUIC stream, and the HTTP/3 server was initialized with no timeout of any kind. The regression was introduced in v2.8.2 when a quic-go API change removed the embedded http.Server that had previously carried these timeouts. The fix (PR #13717) wraps the HTTP/3 handler with a withReadTimeout middleware that applies a per-request read deadline via http.ResponseController.SetReadDeadline, and also populates IdleTimeout and MaxHeaderBytes directly on http3.Server (GitHub Advisory, Fix PR, Fix Commit).

An unauthenticated remote attacker can send HTTP/3 requests with a slow-trickling request body — sending data at a trickle indefinitely — holding both the Traefik request and an upstream backend connection open for as long as desired, at negligible cost to the attacker. Because each held request occupies one upstream connection, backends with bounded connection pools are the primary pressure point and can be exhausted, resulting in degraded or complete loss of service availability for legitimate users. There is no confidentiality or integrity impact; the vulnerability is limited to availability (GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires no authentication, no user interaction, and low complexity — any client capable of sending HTTP/3 (QUIC) requests can exploit this — but the impact is limited to availability (GitHub Advisory, Feedly).

1. Identify target: Locate a Traefik instance (v2.8.2–v2.11.55 or v3.0.0–v3.7.11) with HTTP/3 enabled on an entrypoint (look for http3: blocks in the static configuration or Alt-Svc: h3 response headers).
2. Establish HTTP/3 connection: Use an HTTP/3-capable client (e.g., curl with --http3-only and a QUIC-capable build, or a custom QUIC client) to connect to the target's HTTPS/QUIC port.
3. Send slow-body request: Issue an HTTP POST or PUT request with a request body that trickles data at a very slow rate (e.g., one byte every few seconds), keeping the QUIC stream open without triggering any timeout:

   { for i in $(seq 1 500); do printf 'x'; sleep 4; done; } | \
     curl -v -k -T - --http3-only https://target:443/

4. Hold upstream connections: Because Traefik forwards the request to a backend before the body is fully received (if the backend reads the body), each slow request pins one upstream backend connection open indefinitely.
5. Scale the attack: Open many simultaneous slow-body HTTP/3 connections to exhaust the backend's connection pool, causing legitimate requests to be queued or rejected, resulting in denial of service (GitHub Advisory).

• Network: Unusually high number of long-lived QUIC/UDP connections to the Traefik entrypoint port; upstream backend connections held open far beyond the configured readTimeout value (default 60s); low-bandwidth HTTP/3 POST/PUT requests with no completion.
• Logs: Traefik access logs showing HTTP/3 (proto=HTTP/3.0) POST or PUT requests with very long durations and no response code logged (connection never closed); backend logs showing connections held open with no request body completion.
• Process/Resource: Elevated number of open file descriptors or goroutines in the Traefik process; backend connection pool exhaustion errors or queue depth alerts; upstream services reporting connection limit reached.

The primary remediation is to upgrade Traefik to v2.11.56 (v2.x branch) or v3.7.12 (v3.x branch), which apply readTimeout, idleTimeout, and maxHeaderBytes to HTTP/3 entrypoints (v2.11.56 Release, v3.7.12 Release). Versions on the v2.8.2–v2.10.x and v3.0–v3.6 lines will not receive backport patches and must upgrade to the fixed branches. As a temporary workaround if immediate patching is not possible: disable HTTP/3 entrypoints by removing the http3: block from the static configuration, or implement upstream connection pool limits and request timeouts at the network or load-balancer level to bound slow-read attacks (GitHub Advisory).

The vulnerability was reported by a penetration tester (credited as ShadMalloy, affiliated with Bishop Fox) who provided a detailed reproducer and root-cause analysis, including source code citations and measured upstream connection hold times. The Traefik maintainers responded promptly, with the fix reviewed and merged within days of the private report and patches released on August 26, 2026. The NixOS security tracker opened a backport issue (NixOS/nixpkgs#562167) shortly after disclosure, indicating community awareness and downstream packaging activity (GitHub Advisory, Fix PR).