CVE-2024-28869: Insufficient Information (NVD-CWE-noinfo)
value: Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-12T22:15Z
Repository: https://github.com/traefik/traefik
Language: Markdown
Files changed: docs/content/migration/v2.md, docs/content/reference/static-configuration/cli-ref.md, docs/content/reference/static-configuration/env-ref.md, docs/content/routing/entrypoints.md, pkg/config/static/static_config.go
Commit date: 2024-04-11 17:18:03 +0200
Commit message: Set default ReadTimeout value to 60s

Co-authored-by: Kevin Pollet <pollet.kevin@gmail.com>
Diff: diff --git a/docs/content/migration/v2.md b/docs/content/migration/v2.md
index 669ebf705..980b3716b 100644
--- a/docs/content/migration/v2.md
+++ b/docs/content/migration/v2.md
@@ -621,22 +621,19 @@ Starting with `v2.11.2` the `<entrypoint>.transport.respondingTimeouts.tcp.linge
 Starting with `v2.11.2` the `respondingTimeouts.tcp` and `respondingTimeouts.http` sections introduced in `v2.11.1` have been removed.
 To configure responding timeouts
 
 ### EntryPoint.Transport.RespondingTimeouts.ReadTimeout
 
-Starting with `v2.11.2` the entryPoints `readTimeout` option default value changed to 5 seconds.
+Starting with `v2.11.2` the entryPoints [`readTimeout`](../routing/entrypoints.md#respondingtimeouts) option default value changed to 60 seconds.
 
 For HTTP, this option defines the maximum duration for reading the entire request, including the body.
 For TCP, this option defines the maximum duration for the first bytes to be read on the connection.
 
 The default value was previously set to zero, which means no timeout.
 
 This change has been done to avoid Traefik instances with the default configuration to be hanging forever while waiting for bytes to be read on the connection.
 
-We suggest to adapt this value accordingly to your situation, as the new default value is purposely narrowed,
-it can make the connection be closed too early.
-
 Increasing the `readTimeout` value could be the solution notably if you are dealing with the following errors:
 
 - TCP: `Error while handling TCP connection: readfrom tcp X.X.X.X:X->X.X.X.X:X: read tcp X.X.X.X:X->X.X.X.X:X: i/o timeout`
 - HTTP: `'499 Client Closed Request' caused by: context canceled`
 - HTTP: `ReverseProxy read error during body copy: read tcp X.X.X.X:X->X.X.X.X:X: use of closed network connection`
diff --git a/docs/content/reference/static-configuration/cli-ref.md b/docs/content/reference/static-configuration/cli-ref.md
index 81aed712a..f98e1a177 100644
--- a/docs/content/reference/static-configuration/cli-ref.md
+++ b/docs/content/reference/static-configuration/cli-ref.md
@@ -185,11 +185,11 @@ Duration to keep accepting requests before Traefik initiates the graceful shutdo
 
 `--entrypoints.<name>.transport.respondingtimeouts.idletimeout`:  
 IdleTimeout is the maximum amount duration an idle (keep-alive) connection will remain idle before closing itself. If zero, no timeout is set. (Default: ```180```)
 
 `--entrypoints.<name>.transport.respondingtimeouts.readtimeout`:  
-ReadTimeout is the maximum duration for reading the entire request, including the body. If zero, no timeout is set. (Default: ```5```)
+ReadTimeout is the maximum duration for reading the entire request, including the body. If zero, no timeout is set. (Default: ```60```)
 
 `--entrypoints.<name>.transport.respondingtimeouts.writetimeout`:  
 WriteTimeout is the maximum duration before timing out writes of the response. If zero, no timeout is set. (Default: ```0```)
 
 `--entrypoints.<name>.udp.timeout`:  
diff --git a/docs/content/reference/static-configuration/env-ref.md b/docs/content/reference/static-configuration/env-ref.md
index 605aecfed..d71ffe6c7 100644
--- a/docs/content/reference/static-configuration/env-ref.md
+++ b/docs/content/reference/static-configuration/env-ref.md
@@ -185,11 +185,11 @@ Duration to keep accepting requests before Traefik initiates the graceful shutdo
 
 `TRAEFIK_ENTRYPOINTS_<NAME>_TRANSPORT_RESPONDINGTIMEOUTS_IDLETIMEOUT`:  
 IdleTimeout is the maximum amount duration an idle (keep-alive) connection will remain idle before closing itself. If zero, no timeout is set. (Default: ```180```)
 
 `TRAEFIK_ENTRYPOINTS_<NAME>_TRANSPORT_RESPONDINGTIMEOUTS_READTIMEOUT`:  
-ReadTimeout is the maximum duration for reading the entire request, including the body. If zero, no timeout is set. (Default: ```5```)
+ReadTimeout is the maximum duration for reading the entire request, including the body. If zero, no timeout is set. (Default: ```60```)
 
 `TRAEFIK_ENTRYPOINTS_<NAME>_TRANSPORT_RESPONDINGTIMEOUTS_WRITETIMEOUT`:  
 WriteTimeout is the maximum duration before timing out writes of the response. If zero, no timeout is set. (Default: ```0```)
 
 `TRAEFIK_ENTRYPOINTS_<NAME>_UDP_TIMEOUT`:  
diff --git a/docs/content/routing/entrypoints.md b/docs/content/routing/entrypoints.md
index 685db070c..a162f1839 100644
--- a/docs/content/routing/entrypoints.md
+++ b/docs/content/routing/entrypoints.md
@@ -400,18 +400,18 @@ You can configure Traefik to trust the forwarded headers information (`X-Forward
 `respondingTimeouts` are timeouts for incoming requests to the Traefik instance.
 Setting them has no effect for UDP entryPoints.
 
 ??? info "`transport.respondingTimeouts.readTimeout`"
 
-    _Optional, Default=5s_
+    _Optional, Default=60s_
 
     `readTimeout` is the maximum duration for reading the entire request, including the body.
 
     If zero, no timeout exists.  
     Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
     If no units are provided, the value is parsed assuming seconds.
-    For requests with large payloads, this timeout value might be increased.
+    We strongly suggest to adapt this value accordingly to the your needs.
 
     ```yaml tab="File (YAML)"
     ## Static configuration
     entryPoints:
       name:
diff --git a/pkg/config/static/static_config.go b/pkg/config/static/static_config.go
index 6e43e3105..50a6dbdb5 100644
--- a/pkg/config/static/static_config.go
+++ b/pkg/config/static/static_config.go
@@ -49,11 +49,11 @@ const (
 
 	// DefaultIdleTimeout before closing an idle connection.
 	DefaultIdleTimeout = 180 * time.Second
 
 	// DefaultReadTimeout defines the default maximum duration for reading the entire request, including the body.
-	DefaultReadTimeout = 5 * time.Second
+	DefaultReadTimeout = 60 * time.Second
 
 	// DefaultAcmeCAServer is the default ACME API endpoint.
 	DefaultAcmeCAServer = "https://acme-v02.api.letsencrypt.org/directory"
 
 	// DefaultUDPTimeout defines how long to wait by default on an idle session,

Vulnerable code: Starting with `v2.11.2` the entryPoints `readTimeout` option default value changed to 5 seconds.
We suggest to adapt this value accordingly to your situation, as the new default value is purposely narrowed,
it can make the connection be closed too early.

ReadTimeout is the maximum duration for reading the entire request, including the body. If zero, no timeout is set. (Default: ```5```)
ReadTimeout is the maximum duration for reading the entire request, including the body. If zero, no timeout is set. (Default: ```5```)
    _Optional, Default=5s_
    For requests with large payloads, this timeout value might be increased.
	DefaultReadTimeout = 5 * time.Second
Fixed code: Starting with `v2.11.2` the entryPoints [`readTimeout`](../routing/entrypoints.md#respondingtimeouts) option default value changed to 60 seconds.
ReadTimeout is the maximum duration for reading the entire request, including the body. If zero, no timeout is set. (Default: ```60```)
ReadTimeout is the maximum duration for reading the entire request, including the body. If zero, no timeout is set. (Default: ```60```)
    _Optional, Default=60s_
    We strongly suggest to adapt this value accordingly to the your needs.
	DefaultReadTimeout = 60 * time.Second