CVE-2024-28869 - CVE House
Back to Database
Status published High CVE-2024-28869

Possible denial of service vulnerability with Content-length header in Traefik

Vulnerability Description

Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-28869

Credits & Attribution

No credits recorded in the NVD database.

References

More from traefik

View All →
CVE-2025-66491
Traefik has Inverted TLS Verification Logic in its ingress-nginx Provider
Medium 5.9
CVE-2025-66490
Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules
Medium 6.9
CVE-2025-54386
Traefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution
High 7.3
CVE-2025-47952
Traefik allows path traversal using url encoding
Low 2.9
CVE-2025-32431
Traefik has a possible vulnerability with the path matchers
High 8.8

Affected Vendor

Affected Software

traefik
Vulnerable Versions:
< 2.11.2, >= 3.0.0-rc1, < 3.0.0-rc5

Timeline

Official Publish: April 12th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-755

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1203 Exploitation for Client Execution
Execution
T1213 Data from Information Repositories
Collection
T1499 Endpoint Denial of Service
Impact