CVE-2024-45506: High severity HAProxy HAProxy vulnerability
HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2send loop) under a certain set of conditions, as exploited in the wild in 2024.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/haproxyto a version that resolves this vulnerability.Fixed in 2.9.10-1 - Upgrade
Upgrade
debian/haproxyto a version that resolves this vulnerability.Fixed in 2.6.12-1+deb12u3Fixed in 2.6.12-1+deb12u4Fixed in 3.0.11-1+deb13u3Fixed in 3.0.11-1+deb13u4Fixed in 3.2.26-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45506?
CVE-2024-45506 is classified as a remote denial of service vulnerability.
Which HAProxy versions are affected by CVE-2024-45506?
The affected HAProxy versions are 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6.
How do I fix CVE-2024-45506?
To fix CVE-2024-45506, upgrade your HAProxy to version 2.9.10 or 3.0.4 and later.
What types of attacks does CVE-2024-45506 facilitate?
CVE-2024-45506 facilitates remote denial of service attacks against the HAProxy service.
Is exploit code available for CVE-2024-45506?
As of the latest information, there is no publicly available exploit code for CVE-2024-45506.