CVE-2024-28869 (published 2024-04-12T22:15Z)

Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/traefik/traefik
commit_details: repo_url: https://github.com/traefik/traefik
author: Romain
author_date: 2024-04-11 17:18:03+02:00
msg: Set default ReadTimeout value to 60s

Co-authored-by: Kevin Pollet <pollet.kevin@gmail.com>
repository: repo_url: https://github.com/traefik/traefik
repo_name: traefik/traefik
description: The Cloud Native Application Proxy
repo_language: Go
owner: traefik
file_changes: filename: v2.md
change_type: ModificationType.MODIFY
diff: @@ -623,7 +623,7 @@ To configure responding timeouts
 
 ### EntryPoint.Transport.RespondingTimeouts.ReadTimeout
 
-Starting with `v2.11.2` the entryPoints `readTimeout` option default value changed to 5 seconds.
+Starting with `v2.11.2` the entryPoints [`readTimeout`](../routing/entrypoints.md#respondingtimeouts) option default value changed to 60 seconds.
 
 For HTTP, this option defines the maximum duration for reading the entire request, including the body.
 For TCP, this option defines the maximum duration for the first bytes to be read on the connection.
@@ -632,9 +632,6 @@ The default value was previously set to zero, which means no timeout.
 
 This change has been done to avoid Traefik instances with the default configuration to be hanging forever while waiting for bytes to be read on the connection.
 
-We suggest to adapt this value accordingly to your situation, as the new default value is purposely narrowed,
-it can make the connection be closed too early.
-
 Increasing the `readTimeout` value could be the solution notably if you are dealing with the following errors:
 
 - TCP: `Error while handling TCP connection: readfrom tcp X.X.X.X:X->X.X.X.X:X: read tcp X.X.X.X:X->X.X.X.X:X: i/o timeout`

programming_language: Markdown
filename: cli-ref.md
change_type: ModificationType.MODIFY
diff: @@ -187,7 +187,7 @@ Duration to keep accepting requests before Traefik initiates the graceful shutdo
 IdleTimeout is the maximum amount duration an idle (keep-alive) connection will remain idle before closing itself. If zero, no timeout is set. (Default: ```180```)
 
 `--entrypoints.<name>.transport.respondingtimeouts.readtimeout`:  
-ReadTimeout is the maximum duration for reading the entire request, including the body. If zero, no timeout is set. (Default: ```5```)
+ReadTimeout is the maximum duration for reading the entire request, including the body. If zero, no timeout is set. (Default: ```60```)
 
 `--entrypoints.<name>.transport.respondingtimeouts.writetimeout`:  
 WriteTimeout is the maximum duration before timing out writes of the response. If zero, no timeout is set. (Default: ```0```)

programming_language: Markdown
filename: env-ref.md
change_type: ModificationType.MODIFY
diff: @@ -187,7 +187,7 @@ Duration to keep accepting requests before Traefik initiates the graceful shutdo
 IdleTimeout is the maximum amount duration an idle (keep-alive) connection will remain idle before closing itself. If zero, no timeout is set. (Default: ```180```)
 
 `TRAEFIK_ENTRYPOINTS_<NAME>_TRANSPORT_RESPONDINGTIMEOUTS_READTIMEOUT`:  
-ReadTimeout is the maximum duration for reading the entire request, including the body. If zero, no timeout is set. (Default: ```5```)
+ReadTimeout is the maximum duration for reading the entire request, including the body. If zero, no timeout is set. (Default: ```60```)
 
 `TRAEFIK_ENTRYPOINTS_<NAME>_TRANSPORT_RESPONDINGTIMEOUTS_WRITETIMEOUT`:  
 WriteTimeout is the maximum duration before timing out writes of the response. If zero, no timeout is set. (Default: ```0```)

programming_language: Markdown
filename: entrypoints.md
change_type: ModificationType.MODIFY
diff: @@ -402,14 +402,14 @@ Setting them has no effect for UDP entryPoints.
 
 ??? info "`transport.respondingTimeouts.readTimeout`"
 
-    _Optional, Default=5s_
+    _Optional, Default=60s_
 
     `readTimeout` is the maximum duration for reading the entire request, including the body.
 
     If zero, no timeout exists.  
     Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
     If no units are provided, the value is parsed assuming seconds.
-    For requests with large payloads, this timeout value might be increased.
+    We strongly suggest to adapt this value accordingly to the your needs.
 
     ```yaml tab="File (YAML)"
     ## Static configuration

programming_language: Markdown
filename: static_config.go
change_type: ModificationType.MODIFY
diff: @@ -51,7 +51,7 @@ const (
 	DefaultIdleTimeout = 180 * time.Second
 
 	// DefaultReadTimeout defines the default maximum duration for reading the entire request, including the body.
-	DefaultReadTimeout = 5 * time.Second
+	DefaultReadTimeout = 60 * time.Second
 
 	// DefaultAcmeCAServer is the default ACME API endpoint.
 	DefaultAcmeCAServer = "https://acme-v02.api.letsencrypt.org/directory"

programming_language: Go