# Missing timeouts and size caps in proxies

Proxies and alternate transports that enforce limits only on one path, transport, or framing

_Area: Web infrastructure and server-side requests. Seen in 2 disclosed reports; one confirmed bounty: $400; latest 2026-08-31. Updated 2026-11-02._

## How it works
A handler that reads from a client or fetches a user-supplied URL must bound how long it waits and how much it accepts. The assumption that breaks is that a limit set in one place covers every path. A timeout applied as a TCP connection deadline never reaches a QUIC stream, so HTTP/3 requests hold upstream connections open indefinitely [E3](https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-traefik-version-through-3-7-11.md). A size cap that trusts `Content-Length` is bypassed by `Transfer-Encoding: chunked`, which carries no length, and a response timeout is defeated by trickling a byte every few seconds [E1](https://bugbountylibrary.com/r/h1%3A507525.md). The resource (socket, worker, CPU, bandwidth) is held until the peer chooses to stop.

## Where it shows up
- Image/asset proxies that fetch user-linked URLs (Camo-style) [E1](https://bugbountylibrary.com/r/h1%3A507525.md)
- Reverse proxies with per-transport entrypoints: HTTP/1.1, HTTP/2, HTTP/3/QUIC, Unix sockets [E3](https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-traefik-version-through-3-7-11.md)
- Timeouts set as connection deadlines rather than per-request or per-stream deadlines [E3](https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-traefik-version-through-3-7-11.md)
- Size limits checked against `Content-Length` only, with no cap on chunked bodies [E1](https://bugbountylibrary.com/r/h1%3A507525.md)
- Regexes in type-coercion or parsing code with adjacent quantifiers that can match the same character [E2](https://bugbountylibrary.com/r/h1%3A1023899.md)

## How to review
For every read path, find the exact enforcement point and ask which transports and framings reach it. The invariant: each request or stream has its own deadline and byte cap, enforced after framing is decoded, independent of `Content-Length`, and applied identically on every transport the server accepts. For regexes, check that no character can be matched by two adjacent quantifiers; `,` matching both `\D*` and `[\d,]+` gives O(n^2) backtracking [E2](https://bugbountylibrary.com/r/h1%3A1023899.md).

## How finders spotted it
- Noticed the proxy fetches user-linked images, hypothesized missing timeout and size controls, then tested slow trickle and oversized chunked bodies, confirming via nginx access logs and netstat [E1](https://bugbountylibrary.com/r/h1%3A507525.md)
- Read the Money type regex and saw `,` could match both `\D*` and `[\d,]+`, predicted quadratic backtracking, confirmed with crafted input [E2](https://bugbountylibrary.com/r/h1%3A1023899.md)
- Saw the read timeout implemented as a TCP connection deadline, reasoned it cannot reach a QUIC stream, confirmed the HTTP/3 server was built without timeouts, then ran a differential test with a body-reading backend and HTTP/1.1 as control on the same binary and config [E3](https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-traefik-version-through-3-7-11.md)

## Variants seen
- Asset proxy with no response timeout and no chunked size cap [E1](https://bugbountylibrary.com/r/h1%3A507525.md)
- ReDoS in a database type-coercion regex [E2](https://bugbountylibrary.com/r/h1%3A1023899.md)
- Timeout enforced at TCP layer, absent on HTTP/3/QUIC entrypoint [E3](https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-traefik-version-through-3-7-11.md)

## Impact and severity
Exhausted proxy sockets and bandwidth, crashed visitor browsers [E1](https://bugbountylibrary.com/r/h1%3A507525.md); CPU saturation from crafted strings [E2](https://bugbountylibrary.com/r/h1%3A1023899.md); held upstream connections exhausting backend pools [E3](https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-traefik-version-through-3-7-11.md). Impact rose where the proxy followed redirects and could be aimed at external sites, and where CDN bypass via `--resolve` reached origin IPs directly [E1](https://bugbountylibrary.com/r/h1%3A507525.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **github.com/traefik/traefik/v2 (go)** (HTTP/3 server (server_entrypoint_tcp_http3.go)) fixed in 2.11.56 or 3.7.12: Traefik | Version Through 3.7.11. Report: https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-traefik-version-through-3-7-11.md

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A507525.md
- E2: https://bugbountylibrary.com/r/h1%3A1023899.md
- E3: https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-traefik-version-through-3-7-11.md