Traefik HTTP/3 Request Read Timeout Bypass Through Version 3...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://bishopfox.com/blog/traefik-version-through-3-7-11
• Blog Title: Traefik HTTP/3 Request Read Timeout Bypass Through Version 3.7.11
• Suggested Section: Network Services Pentesting > 80,443 - Pentesting Web Methodology > Traefik / HTTP/3 and QUIC slow-body resource exhaustion

🎯 Content Summary

Overview

Bishop Fox discovered a remotely exploitable, medium-severity uncontrolled resource-consumption vulnerability in Traefik's HTTP/3 request path. The issue is tracked as GHSA-7ghq-v6jf-g56c; no CVE had been assigned at publication. It is classified as CWE-770: Allocation of Resources Without Limits or Throttling with CVSS 3.1 score 5.3 and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. Exploitation is remote,...

🔧 Technical Details

HTTP/3 slow-body resource exhaustion: When a reverse proxy implements incoming-request deadlines on TCP connections, independently test its HTTP/3/QUIC path. If the HTTP/3 server reuses only an HTTP handler and does not implement equivalent QUIC-stream or request-body deadlines, an attacker can send a valid body one byte every few seconds—or stop sending without closing the stream—to keep requests open indefinitely. Where the proxy streams the body to an upstream application that waits for completion, each request can pin one backend connection, enabling low-bandwidth exhaustion of bounded connection pools.

Protocol-differential timeout testing: Send the same slow upload over HTTP/1.1 and HTTP/3 against the same process and configuration, ensuring that the upload duration exceeds the configured timeout. Use HTTP/1.1 as the control to prove that the setting is active. Measure the upstream connection lifetime at a backend that reads the complete...

🤖 Agent Actions

Implemented the HackTricks update.

Changes

• Added src/network-services-pentesting/pentesting-web/traefik.md
  • HTTP/3 slow-body resource exhaustion
  • Protocol-differential HTTP/1.1 vs HTTP/3 testing
  • Backend connection-lifetime validation
  • White-box timeout review checklist
  • Technical detection and remediation
  • Numbered references to the advisory, patch, and Bishop Fox research
• Linked the page from:
  • src/network-services-pentesting/pentesting-web/README.md
  • src/SUMMARY.md

Validation

• git diff --check passed.
• All SUMMARY.md local links resolve.
• Citation numbering and reference targets validated.
• All three reference URLs returned HTTP 200.
• mdbook was unavailable in the environment, so a full build was not run.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://bishopfox.com/blog/traefik-version-through-3-7-11

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting > 80,443 - Pentesting Web Methodology > Traefik / HTTP/3 and QUIC slow-body resource exhaustion".

Repository Maintenance:

• MD Files Formatting: 999 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0