Browse CVEs

CRITICAL 9.1 CVE-2026-55203 HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer … Haproxy after 3.4.0 Fix from $2,3002026-06-18 HIGH 7.5 CVE-2026-55204 HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that … Haproxy after 3.4.0 Fix from $1,9502026-06-18 MEDIUM 5.8 CVE-2026-33555 An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced conten… Haproxy 3.3.6+ Fix from $1,6002026-04-13 HIGH 7.5 CVE-2025-11230 Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests. Aloha Appliance 1.9.14-ee7 / 1.11.12-ee10+ Fix from $1,9502025-11-19 HIGH 7.5 CVE-2024-45506 HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_sen… Haproxy 2.9.10 / 3.0.4+ Fix from $1,9502024-09-04 HIGH 8.2 CVE-2023-45539 HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified o… Haproxy 2.8.2+ Fix from $1,9502023-11-28 HIGH 7.2 CVE-2023-40225 HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x… Haproxy 2.6.15 / 2.7.10+ Fix from $1,9502023-08-10 HIGH 7.3 CVE-2023-25950 HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's requ… Haproxy after 2.6.7 Fix from $1,9502023-04-11 HIGH 7.5 CVE-2023-0836 An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 … Haproxy 2.2.27+ Fix from $1,9502023-03-29 HIGH 7.5 CVE-2019-18277EPSS 10% A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being co… Haproxy 2.0.6+ Fix from $1,9502019-10-23 HIGH 7.5 CVE-2019-14243 headerv2.go in mastercactapus proxyprotocol before 0.0.2, as used in the mastercactapus caddy-proxyprotocol plugin through 0.0.2 for Caddy, allows re… Proxyprotocol 0.0.2+ Fix from $1,9502019-07-23 HIGH 7.5 CVE-2019-14241EPSS 70% HAProxy through 2.0.2 allows attackers to cause a denial of service (ha_panic) via vectors related to htx_manage_client_side_cookies in proto_htx.c. Haproxy after 2.0.2 Fix from $1,9502019-07-23 MEDIUM 5.9 CVE-2019-11323 HAProxy before 1.9.7 mishandles a reload with rotated keys, which triggers use of uninitialized, and very predictable, HMAC keys. This is related to … Haproxy 1.9.7+ Fix from $1,6002019-05-09 MEDIUM 5.3 CVE-2016-2102 HAProxy statistics in openstack-tripleo-image-elements are non-authenticated over the network. Haproxy No fix yet Fix from $1,6002017-08-22 MEDIUM 5.0 CVE-2014-6269 Multiple integer overflows in the http_request_forward_body function in proto_http.c in HAProxy 1.5-dev23 before 1.5.4 allow remote attackers to caus… Haproxy No fix yet Fix from $1,6002014-09-30 MEDIUM 5.1 CVE-2013-1912EPSS 5% Buffer overflow in HAProxy 1.4 through 1.4.22 and 1.5-dev through 1.5-dev17, when HTTP keep-alive is enabled, using HTTP keywords in TCP inspection r… Haproxy Mitigation only Fix from $1,6002013-04-10 MEDIUM 5.1 CVE-2012-2942EPSS 5% Buffer overflow in the trash buffer in the header capture functionality in HAProxy before 1.4.21, when global.tune.bufsize is set to a value greater … Haproxy after 1.4.20 Fix from $1,6002012-05-27