Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-45506

HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.

Published

2024-09-04T15:15:14.080

Last Modified

2025-03-14T20:15:13.870

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

Weaknesses

Type: Primary
NVD-CWE-noinfo
Type: Secondary
CWE-835

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	haproxy	haproxy	< 2.9.10	Yes
Application	haproxy	haproxy	< 3.0.4	Yes
Application	haproxy	haproxy	3.1	Yes
Application	haproxy	haproxy	3.1	Yes
Application	haproxy	haproxy	3.1	Yes
Application	haproxy	haproxy	3.1	Yes
Application	haproxy	haproxy	3.1	Yes
Application	haproxy	haproxy	3.1	Yes

References

http://git.haproxy.org/?p=haproxy-3.0.git%3Ba=commitdiff%3Bh=c725db17e8416ffb3c1537aea756356228ce5e3c Broken Link ([email protected])
http://git.haproxy.org/?p=haproxy-3.0.git%3Ba=commitdiff%3Bh=d636e515453320c6e122c313c661a8ac7d387c7f Broken Link ([email protected])
https://www.haproxy.org/ Product ([email protected])
https://www.haproxy.org/download/3.1/src/CHANGELOG Release Notes ([email protected])
https://www.mail-archive.com/haproxy%40formilux.org/msg45280.html Release Notes ([email protected])
https://www.mail-archive.com/haproxy%40formilux.org/msg45281.html Release Notes ([email protected])