CVE-2024-45506
First published: Wed Sep 04 2024(Updated: )
HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Aprox Aproxengine | >=2.9.0<2.9.10 | |
| Aprox Aproxengine | >=3.0.0<3.0.4 | |
| Aprox Aproxengine | =3.1-dev0 | |
| Aprox Aproxengine | =3.1-dev1 | |
| Aprox Aproxengine | =3.1-dev2 | |
| Aprox Aproxengine | =3.1-dev3 | |
| Aprox Aproxengine | =3.1-dev4 | |
| Aprox Aproxengine | =3.1-dev5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.haproxy.org/
- https://www.haproxy.org/download/3.1/src/CHANGELOG
- https://www.mail-archive.com/haproxy%40formilux.org/msg45281.html
- https://www.mail-archive.com/haproxy%40formilux.org/msg45280.html
- http://git.haproxy.org/?p=haproxy-3.0.git%3Ba=commitdiff%3Bh=c725db17e8416ffb3c1537aea756356228ce5e3c
- http://git.haproxy.org/?p=haproxy-3.0.git%3Ba=commitdiff%3Bh=d636e515453320c6e122c313c661a8ac7d387c7f
Frequently Asked Questions
What is the severity of CVE-2024-45506?
CVE-2024-45506 is classified as a remote denial of service vulnerability.
Which HAProxy versions are affected by CVE-2024-45506?
The affected HAProxy versions are 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6.
How do I fix CVE-2024-45506?
To fix CVE-2024-45506, upgrade your HAProxy to version 2.9.10 or 3.0.4 and later.
What types of attacks does CVE-2024-45506 facilitate?
CVE-2024-45506 facilitates remote denial of service attacks against the HAProxy service.
Is exploit code available for CVE-2024-45506?
As of the latest information, there is no publicly available exploit code for CVE-2024-45506.
- agent/references
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/description
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/haproxy
- canonical/aprox aproxengine
- version/aprox aproxengine/2.9.0
- version/aprox aproxengine/3.0.0
- version/aprox aproxengine/3.1-dev0
- version/aprox aproxengine/3.1-dev1
- version/aprox aproxengine/3.1-dev2
- version/aprox aproxengine/3.1-dev3
- version/aprox aproxengine/3.1-dev4
- version/aprox aproxengine/3.1-dev5