CVE-2024-28869High· 7.5▾ TwilightAn improper handling of exceptional conditions vulnerability was found in Traefik. In affected versions, sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
1.0%
Last analysed / modified upstream
An improper handling of exceptional conditions vulnerability was found in Traefik. In affected versions, sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default configuration, resulting in a denial of service.
traefik: denial of service — rated Moderate by Red Hat. Released 2024-04-12, updated 2026-09-21.
Fixed:
Not affected:
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:15847
Affected packages:
github.com/traefik/traefik/v3 >= 3.0.0-beta3, < 3.0.0-rc5github.com/traefik/traefik/v2 < 2.11.2github.com/traefik/traefik < 2.11.2Patched in:
github.com/traefik/traefik/v3 3.0.0-rc5github.com/traefik/traefik/v2 2.11.2github.com/traefik/traefik 2.11.2Connected by shared product, vendor, weakness, or advisory.
CVE-2024-10006High· 8.3hashicorp/consul: consul: Consul L7 Intentions Vulnerable To Headers Bypass (CVE-2024-10006)
CVE-2024-51744Low· 3.1golang-jwt: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt (CVE-2024-517…
CVE-2026-45819High· 7.5baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.
CVE-2026-16730Medium· 5.5A flaw was found in dbus-broker
CVE-2026-95897Medium· 5.5A security vulnerability has been detected in Dask up to 2026.8.0
CVE-2026-13087High· 8.8A heap out-of-bounds write vulnerability was found in the Linux kernel's RPC-over-RDMA server reply path in net/sunrpc/xprtrdma/svc_rdma_sendto.c