DSA-6017-1 haproxy - security update

Bulletin has no description...

QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.

...

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.

...

PT-2025-40954

Name of the Vulnerable Software and Affected Versions HAProxy versions prior to 2.6.12-1+deb12u3 HAProxy versions prior to 3.0.11-1+deb13u1 HAProxy version 3.0.8-1ubuntu1.2 Description HAProxy is susceptible to a denial of service condition when parsing specific JSON numbers. An attacker could...

UBUNTU-CVE-2025-11230

Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests...

CVE-2025-34172

In pfSense CE /usr/local/www/haproxy/haproxystats.php, the value of the showsticktablecontent parameter is displayed after being read from HTTP GET requests. This can enable reflected cross-site scripting when the victim is authenticated...

GHSA-8G2X-6FRQ-Q83X vulnerabilities

Vulnerabilities for packages: haproxy...

CVE-2016-2102 vulnerabilities

Vulnerabilities for packages: haproxy...

GHSA-8G2X-6FRQ-Q83X vulnerabilities

Vulnerabilities for packages: haproxy...

CVE-2016-2102 vulnerabilities

Vulnerabilities for packages: haproxy...

BIT-HAPROXY-2024-45506

HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding h2send loop under a certain set of conditions, as exploited in the wild in 2024...

Linux Distros Unpatched Vulnerability : CVE-2025-6714

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data. This affects MongoDB when configured...

CVE-2025-34172

In pfSense CE /usr/local/www/haproxy/haproxystats.php, the value of the showsticktablecontent parameter is displayed after being read from HTTP GET requests. This can enable reflected cross-site scripting when the victim is authenticated...

CVE-2025-34172

CVE-2025-34172 affects pfSense CE (Netgate pfSense CE HAProxy package). The vulnerability exists in haproxy_stats.php where the value of the showsticktablecontent parameter is read from HTTP GET requests and then displayed, enabling reflected cross-site scripting when the victim is authenticated....

CVE-2025-34172 Netgate pfSense CE HAProxy Package 0.63_10 Reflected Cross-Site Scripting

In pfSense CE /usr/local/www/haproxy/haproxystats.php, the value of the showsticktablecontent parameter is displayed after being read from HTTP GET requests. This can enable reflected cross-site scripting when the victim is authenticated...

CVE-2025-34172 Netgate pfSense CE HAProxy Package 0.63_10 Reflected Cross-Site Scripting

In pfSense CE /usr/local/www/haproxy/haproxystats.php, the value of the showsticktablecontent parameter is displayed after being read from HTTP GET requests. This can enable reflected cross-site scripting when the victim is authenticated...

PT-2025-36932

Name of the Vulnerable Software and Affected Versions: pfSense CE affected versions not specified Description: The value of the showsticktablecontent parameter in /usr/local/www/haproxy/haproxy stats.php is displayed after being read from HTTP GET requests. This can enable reflected cross-site...

Linux Distros Unpatched Vulnerability : CVE-2025-32464

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sampleconvregsub heap-based buffer overflow because of mishandling of the replacement of...

EulerOS 2.0 SP11 : haproxy (EulerOS-SA-2025-1955)

According to the versions of the haproxy package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sampleconvregsub heap-based buffer overflow because of mishandling of the...

EulerOS 2.0 SP13 : haproxy (EulerOS-SA-2025-1977)

According to the versions of the haproxy package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sampleconvregsub heap-based buffer overflow because of mishandling of the...