In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade haproxy | Jun 16, 2020 | Apr 2, 2020 |
| Amazon Linux Ami 2 | — | Upgrade haproxy2-debuginfoUpgrade haproxy2 | Sep 28, 2023 | Apr 2, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 2, 2020 |
| Centos_linux | — | Upgrade haproxy-debuginfoUpgrade haproxyUpgrade haproxy-debugsource | Apr 3, 2020 | Apr 2, 2020 |
| Debian | — | Upgrade haproxy | Apr 6, 2020 | Apr 2, 2020 |
| Freebsd | — | Upgrade haproxy18Upgrade haproxy21Upgrade haproxy19Upgrade haproxy | Apr 3, 2020 | Apr 2, 2020 |
| Gentoo Linux | — | Upgrade net-proxy/haproxy. | Dec 29, 2020 | Apr 2, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade haproxy | May 27, 2020 | Apr 2, 2020 |
| Oracle_linux | — | Upgrade haproxy | Oct 5, 2022 | Apr 2, 2020 |
| Redhat Openshift | — | Upgrade haproxy | Apr 8, 2020 | Apr 2, 2020 |
| Redhat_linux | — | Upgrade haproxyUpgrade haproxy-debuginfoUpgrade haproxy-debugsource | Apr 3, 2020 | Apr 2, 2020 |
| Suse | — | Upgrade haproxy | Apr 5, 2020 | Apr 2, 2020 |
| Ubuntu | — | Upgrade haproxy | Apr 8, 2020 | Apr 2, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub