Latest haproxy haproxy Vulnerabilities

● CVE-2023-45539

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end ru...

Haproxy Haproxy<2.8.2

ubuntu/haproxy<2.6.15-1

ubuntu/haproxy<2.0.31-0ubuntu0.3

ubuntu/haproxy<2.4.22-0ubuntu0.22.04.3

ubuntu/haproxy<2.6.9-1ubuntu1.2

redhat/haproxy<2.8.2

and 1 more

● CVE-2023-40225

HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers...

Haproxy Haproxy<=2.0.32

Haproxy Haproxy>=2.2.0<=2.2.30

Haproxy Haproxy>=2.4.0<=2.4.23

Haproxy Haproxy>=2.5.0<2.6.15

Haproxy Haproxy>=2.7.0<2.7.10

Haproxy Haproxy>=2.8.0<2.8.2

and 9 more

● CVE-2023-25950

HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensitive...

Haproxy Haproxy>=2.6.1<=2.6.7

Haproxy Haproxy=2.7.0

● CVE-2023-0836

An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized ...

Haproxy Haproxy>=2.2.0<2.2.27

Haproxy Haproxy>=2.4.0<=2.4.21

Haproxy Haproxy>=2.5.0<=2.5.11

Haproxy Haproxy>=2.6.0<=2.6.8

Haproxy Haproxy=2.1.0

Haproxy Haproxy=2.3.0

and 2 more

● CVE-2023-25725

HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty...

redhat/haproxy<0:2.4.17-3.el9_1.2

redhat/haproxy<0:2.4.7-2.el9_0.2

redhat/haproxy<0:2.2.19-4.el8

redhat/haproxy<0:2.2.24-3.rhaos4.11.el8

redhat/haproxy<0:2.2.24-3.rhaos4.12.el8

redhat/haproxy<0:2.2.24-3.rhaos4.13.el8

and 16 more

● CVE-2023-0056

An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious...

redhat/haproxy<0:2.4.17-3.el9_1.2

redhat/haproxy<0:2.4.7-2.el9_0.2

redhat/haproxy<0:2.2.19-3.el8

redhat/haproxy<0:2.2.24-2.el8

redhat/haproxy<0:2.2.24-3.rhaos4.13.el8

redhat/haproxy<0:2.2.15-6.el8

and 24 more

● CVE-2022-0711

A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop...

Haproxy Haproxy>=2.2.0<2.2.21

Haproxy Haproxy>=2.3.0<2.3.18

Haproxy Haproxy>=2.4.0<2.4.13

Redhat Openshift Container Platform=4.0

Redhat Software Collections

Redhat Enterprise Linux=7.0

and 8 more

● CVE-2021-40346

An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HA...

debian/haproxy

Haproxy Haproxy>=2.0.0<2.0.25

Haproxy Haproxy>=2.2.0<2.2.17

Haproxy Haproxy>=2.3.0<2.3.14

Haproxy Haproxy>=2.4.0<2.4.4

Haproxy Haproxy=2.5-dev0

and 9 more

● CVE-2021-39240

An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, ...

debian/haproxy

Haproxy Haproxy>=2.2.0<2.2.16

Haproxy Haproxy>=2.3.0<2.3.13

Haproxy Haproxy>=2.4.0<2.4.3

Debian Debian Linux=11.0

Fedoraproject Fedora=33

and 1 more

● CVE-2021-39242

An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead to a situation with an attacker-controlled HTTP Host header, because a mismatch between Host ...

Haproxy Haproxy>=2.2.0<2.2.16

Haproxy Haproxy>=2.3.0<2.3.13

Haproxy Haproxy>=2.4.0<2.4.3

Debian Debian Linux=11.0

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 1 more

● CVE-2021-39241

An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. An HTTP method name may contain a space followed by the name of a protected resource. ...

Haproxy Haproxy>=2.0.0<2.0.24

Haproxy Haproxy>=2.2.0<2.2.16

Haproxy Haproxy>=2.3.0<2.3.13

Haproxy Haproxy>=2.4.0<2.4.3

Debian Debian Linux=11.0

Fedoraproject Fedora=33

and 2 more

● CVE-2020-11100

In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 ...

debian/haproxy

ubuntu/haproxy<1.8.8-1ubuntu0.10

ubuntu/haproxy<2.0.5-1ubuntu0.4

ubuntu/haproxy<2.0.14

redhat/haproxy<2.1.4

Haproxy Haproxy>=1.8.0<2.1.4

and 8 more

● CVE-2019-19330

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Inter...

Haproxy Haproxy<2.0.10

Canonical Ubuntu Linux=18.04

Canonical Ubuntu Linux=19.04

Canonical Ubuntu Linux=19.10

Debian Debian Linux=10.0

redhat/haproxy<2.0.10

and 2 more

● CVE-2019-18277

A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if com...

Haproxy Haproxy<2.0.6

redhat/haproxy<2.0.6

redhat/haproxy<1.8.22

ubuntu/haproxy<1.8.8-1ubuntu0.7

ubuntu/haproxy<1.8.19-1ubuntu1.2

ubuntu/haproxy<2.0.5-1ubuntu0.2

and 3 more

● CVE-2019-14241

Haproxy Haproxy>=1.4<=1.9.8

Haproxy Haproxy>=2.0.0<=2.0.2

● CVE-2019-11323

HAProxy before 1.9.7 mishandles a reload with rotated keys, which triggers use of uninitialized, and very predictable, HMAC keys. This is related to an include/types/ssl_sock.h error.

Haproxy Haproxy>=1.9.2<1.9.7

● CVE-2018-20615

An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder in HAProxy 1.8.x and 1.9.x through 1.9.0 which can result in a crash. The processing of the PRIORITY flag in a HEADERS frame r...

Haproxy Haproxy>=1.8.0<=1.8.19

Haproxy Haproxy=1.9.0

Haproxy Haproxy=1.9.0-dev0

Haproxy Haproxy=1.9.0-dev1

Haproxy Haproxy=1.9.0-dev10

Haproxy Haproxy=1.9.0-dev11

and 23 more

● CVE-2018-20103

An issue was discovered in dns.c in HAProxy through 1.8.14. In the case of a compressed pointer, a crafted packet can trigger infinite recursion by making the pointer point to itself, or create a long...

Haproxy Haproxy<=1.8.14

Canonical Ubuntu Linux=16.04

Canonical Ubuntu Linux=18.04

Canonical Ubuntu Linux=18.10

Redhat Openshift Container Platform=3.11

ubuntu/haproxy<1.8.15-1

and 4 more

● CVE-2018-20102

An out-of-bounds read in dns_validate_dns_response in dns.c was discovered in HAProxy through 1.8.14. Due to a missing check when validating DNS responses, remote attackers might be able read the 16 b...

Haproxy Haproxy<=1.8.14

Canonical Ubuntu Linux=16.04

Canonical Ubuntu Linux=18.04

Canonical Ubuntu Linux=18.10

Redhat Openshift Container Platform=3.11

ubuntu/haproxy<1.8.15-1

and 5 more

● CVE-2018-14645

A flaw was discovered in the HPACK decoder of haproxy before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpack_valid_idx() resulted in a remote crash and denial of service. Accord...

Haproxy Haproxy<=1.8.14

Canonical Ubuntu Linux=18.04

IBM Robotic Process Automation as a Service=3.10

Redhat Openshift Container Platform=3.9

Redhat Enterprise Linux=7.0

Redhat Enterprise Linux=7.3

and 7 more

● CVE-2018-11469

Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 (if cache enabled) allows attackers to achieve information disclosure via an unauthenticated...

Haproxy Haproxy>=1.8.0<=1.8.9

Canonical Ubuntu Linux=18.04

ubuntu/haproxy<1.8.8-1ubuntu0.1

redhat/haproxy<1.8.10

debian/haproxy

Latest haproxy haproxy Vulnerabilities

Company

Resources

Contact