CVE-2018-14645: High severity HAProxy HAProxy vulnerability
A flaw was discovered in the HPACK decoder of haproxy before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpackvalididx() resulted in a remote crash and denial of service. According to the report, there is no risk of escalation or code execution.
Other sources
A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpackvalididx() resulted in a remote crash and denial of service.
— Launchpad
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2018-14645.
What is the severity of CVE-2018-14645?
The severity of CVE-2018-14645 is high with a CVSS score of 7.5.
What is the affected software?
The affected software includes HAProxy versions before 1.8.14 and some versions of Ubuntu, Debian, Redhat, and Haproxy.
How can I fix CVE-2018-14645?
You can fix CVE-2018-14645 by updating HAProxy to version 1.8.14 or newer.
Where can I find more information about CVE-2018-14645?
You can find more information about CVE-2018-14645 on the Red Hat website and Bugzilla.