BIT-haproxy-2024-45506: High severity HAProxy HAProxy vulnerability
HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2send loop) under a certain set of conditions, as exploited in the wild in 2024.
Affected Software
Event History
Frequently Asked Questions
Does an attacker need credentials or user interaction to trigger the issue?
No. The vector is network-accessible, with no privileges or user interaction required.
Which deployments should be prioritized for remediation?
Prioritize externally reachable HAProxy instances using affected 2.9.x, 3.0.x, or 3.1 development releases, particularly where HTTP/2 zero-copy forwarding is in use. The issue was exploited in the wild in 2024 and can cause denial of service.
Which release lines have identified fixed versions?
For the 2.9 release line, versions before 2.9.10 are affected; for 3.0, versions before 3.0.4 are affected. The provided data identifies 3.1.x through 3.1-dev6 as affected but does not specify a fixed 3.1 release.