CVE-2025-32464: Buffer Overflow
First published: Wed Apr 09 2025(Updated: )
HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling of the replacement of multiple short patterns with a longer one.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| HAProxy | >=2.2<=3.1.6 | |
| debian/haproxy | <=2.2.9-2+deb11u6<=2.6.12-1+deb12u1<=3.0.9-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/haproxy/haproxy/commit/3e3b9eebf871510aee36c3a3336faac2f38c9559
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32464
- https://nvd.nist.gov/vuln/detail/CVE-2025-32464
- https://launchpad.net/bugs/cve/CVE-2025-32464
- https://security-tracker.debian.org/tracker/CVE-2025-32464
- https://ubuntu.com/security/CVE-2025-32464
- https://github.com/haproxy/haproxy/commit/07e1e3c93e74e44389545e457f0e1ff2e807cb9a
- https://git.haproxy.org/?p=haproxy-3.0.git;a=commit;h=ee1a64c2a04cc2cb38efb7e44f7ea7386d627bf6
- https://lists.debian.org/debian-lts-announce/2025/04/msg00031.html
Frequently Asked Questions
What is the severity of CVE-2025-32464?
CVE-2025-32464 is classified as a high severity vulnerability due to its potential for a heap-based buffer overflow.
How do I fix CVE-2025-32464?
To mitigate CVE-2025-32464, upgrade HAProxy to version 3.1.7 or later where the vulnerability has been addressed.
What versions of HAProxy are affected by CVE-2025-32464?
CVE-2025-32464 affects HAProxy versions 2.2 through 3.1.6.
What is the impact of CVE-2025-32464 on HAProxy?
The impact of CVE-2025-32464 includes a potential crash or arbitrary code execution due to a buffer overflow.
In which configurations does CVE-2025-32464 occur?
CVE-2025-32464 may be triggered in certain uncommon configurations involving multiple short patterns replaced by a longer one.
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/severity
- agent/author
- agent/guess-ai
- agent/software-canonical-lookup
- collector/nvd-cve
- source/NVD
- agent/source
- agent/softwarecombine
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/usn-cve
- source/Ubuntu
- agent/description
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/references
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- vendor/haproxy technologies
- canonical/haproxy
- package-manager/debian