GHSA-4vwx-54mw-vqfw Traefik vulnerable to denial of service with Content-length header

• Go github.com/traefik/traefik/v3: >= 3.0.0-beta3, < 3.0.0-rc5 → fixed in 3.0.0-rc5 • Go github.com/traefik/traefik/v2: < 2.11.2 → fixed in 2.11.2 • Go github.com/traefik/traefik: < 2.11.2 → fixed in 2.11.2

There is a potential vulnerability in Traefik managing requests with `Content-length` and no `body` . Sending a `GET` request to any Traefik endpoint with the `Content-length` request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. Patches • https://github.com/traefik/traefik/releases/tag/v2.11.2 • https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5 Workarounds For affected versions, this vulnerability can be mitigated by configuring the readTimeout option. For more information If you have any questions or comments about this advisory, please open an issue.