In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-haproxy | Jun 16, 2020 | Apr 2, 2020 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-haproxy2amazon-linux-ami-2-upgrade-haproxy2-debuginfo | Sep 28, 2023 | Apr 2, 2020 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Apr 2, 2020 | |
| Centos_linux | — | centos-upgrade-haproxycentos-upgrade-haproxy-debuginfocentos-upgrade-haproxy-debugsource | Apr 3, 2020 | Apr 2, 2020 |
| Debian | debian-upgrade-haproxy | Apr 6, 2020 | Apr 2, 2020 | |
| Freebsd | freebsd-upgrade-package-haproxyfreebsd-upgrade-package-haproxy18freebsd-upgrade-package-haproxy19freebsd-upgrade-package-haproxy21 | Apr 3, 2020 | Apr 2, 2020 | |
| Gentoo Linux | gentoo-linux-upgrade-net-proxy-haproxy | Dec 29, 2020 | Apr 2, 2020 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-haproxy | May 27, 2020 | Apr 2, 2020 | |
| Oracle_linux | — | oracle-linux-upgrade-haproxy | Oct 5, 2022 | Apr 2, 2020 |
| Redhat Openshift | linuxrpm-upgrade-haproxy | Apr 8, 2020 | Apr 2, 2020 | |
| Redhat_linux | redhat-upgrade-haproxyredhat-upgrade-haproxy-debuginforedhat-upgrade-haproxy-debugsource | Apr 3, 2020 | Apr 2, 2020 | |
| Suse | — | suse-upgrade-haproxy | Apr 5, 2020 | Apr 2, 2020 |
| Ubuntu | ubuntu-upgrade-haproxy | Apr 8, 2020 | Apr 2, 2020 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Apr 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub