Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-28869

CVE-2024-28869: Traefik vulnerable to denial of service with Content-length header

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-28869
GHSA ID
GHSA-4vwx-54mw-vqfw
EPSS Score
0.30157%
CWE
CWE-404
Published
4/12/2024
Updated
4/15/2024
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/traefik/traefik/v3go>= 3.0.0-beta3, <= 3.0.0-rc43.0.0-rc5
github.com/traefik/traefik/v2go<= 2.11.12.11.2
github.com/traefik/traefikgo<= 2.11.12.11.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper handling of requests with Content-Length headers and no body, causing Traefik to wait indefinitely. The patch explicitly changes the DefaultReadTimeout from 5s to 60s in static_config.go, indicating this configuration value directly influenced the timeout behavior. The CWE-404 (resource shutdown failure) and CWE-755 (exceptional condition mishandling) align with the lack of proper timeout enforcement. While no specific request-handling function is named in the provided data, the DefaultReadTimeout constant's role in configuring server timeouts makes it the clearest vulnerable component.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T**r* is * pot*nti*l vuln*r**ility in Tr***ik m*n**in* r*qu*sts wit* `*ont*nt-l*n*t*` *n* no `*o*y` . S*n*in* * `**T` r*qu*st to *ny Tr***ik *n*point wit* t** `*ont*nt-l*n*t*` r*qu*st *****r r*sults in *n in***init* **n* wit* t** ****ult *on*i*ur*ti

Reasoning

T** vuln*r**ility st*ms *rom improp*r **n*lin* o* r*qu*sts wit* *ont*nt-L*n*t* *****rs *n* no *o*y, **usin* Tr***ik to w*it in***init*ly. T** p*t** *xpli*itly ***n**s t** `****ultR***Tim*out` *rom *s to **s in `st*ti*_*on*i*.*o`, in*i**tin* t*is *on*