CVE-2018-11469: Infoleak
Published May 25, 2018
·Updated
Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 (if cache enabled) allows attackers to achieve information disclosure via an unauthenticated remote request, related to the protohttp.c checkrequestforcacheability function.
Affected Software
4 affected componentsFixes available
redhat/haproxy<1.8.10
1.8.10
HAProxy HAProxy>=1.8.0<=1.8.9
Canonical Ubuntu Linux=18.04
debian/haproxy
2.2.9-2+deb11u62.2.9-2+deb11u72.6.12-1+deb12u33.0.11-1+deb13u13.0.11-1+deb13u23.2.13-1
Remediation
Event History
May 25, 2018
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:29 PM
DescriptionSeverityWeaknessAffected Software
Feb 20, 2026
Data Sourced
via Ubuntu·04:11 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·04:11 PM
Description
Feb 22, 2026
Data Sourced
via Debian·04:13 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for the incorrect caching vulnerability in HAProxy?
The vulnerability ID is CVE-2018-11469.
2
What is the severity rating of CVE-2018-11469?
The severity rating is 5.9 (medium).
3
How does CVE-2018-11469 affect HAProxy?
CVE-2018-11469 allows attackers to achieve information disclosure via an unauthenticated remote request if cache is enabled.
4
Which versions of HAProxy are affected by CVE-2018-11469?
HAProxy versions 1.8.0 through 1.8.9 are affected by CVE-2018-11469.
5
How can I fix the incorrect caching vulnerability in HAProxy?
To fix the vulnerability, update HAProxy to version 1.8.10 or higher.