VulnCheck KEV: CVE-2022-31161

Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subprocessexecute function without processing the inputs received from the user in the /app/options.py file. Version 6.1.1.0 contains a patch for...

Fedora: Security Advisory (FEDORA-2024-bd2368f66a)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-35195

The official haproxy docker images before 1.8.18-alpine Alpine specific contain a blank password for a root user. System using the haproxy docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password...

CVE-2019-14243

headerv2.go in mastercactapus proxyprotocol before 0.0.2, as used in the mastercactapus caddy-proxyprotocol plugin through 0.0.2 for Caddy, allows remote attackers to cause a denial of service webserver panic and daemon crash via a crafted HAProxy PROXY v2 request with truncated source/destinatio...

The vulnerability of programming tools for balancing and managing connections in Pgpool-II and HAProxy for PostgreSQL databases lies in their insecure resource initialization, which allows attackers to gain unauthorized access to the database.

The vulnerabilities of the Pgpool-II and HAProxy software for PostgreSQL databases in terms of connection balancing and management involve insecure resource initialization. Exploiting these vulnerabilities can allow an attacker, operating remotely, to gain unauthorized access to the database with...

Alibaba Cloud Linux 3 : 0104: haproxy (ALINUX3-SA-2024:0104)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0104 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2023-40225: HAProxy through 2.0.32,...

Alibaba Cloud Linux 3 : 0053: haproxy (ALINUX3-SA-2024:0053)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0053 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2023-0056: An uncontrolled resource...

Alibaba Cloud Linux 3 : 0043: haproxy (ALINUX3-SA-2022:0043)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2022:0043 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2020-11100: In hpackdhtinsert in hpack-tbl.c in...

haproxy:fuzz_cfg_parser: Heap-buffer-overflow in sanitize_for_printing

Project: https://github.com/haproxy/haproxy.git Detailed Report: https://oss-fuzz.com/testcase?key=5202563081502720 Project: haproxy Fuzzing Engine: afl Fuzz Target: fuzzcfgparser Job Type: aflasanhaproxy Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x51d000000880 Cra...

SUSE CVE-2025-46728

cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Prior to version 0.20.1, the library fails to enforce configured size limits on incoming request bodies when Transfer-Encoding: chunked is used or when no Content-Length header is provided. A remote attacker can send a chunked...

haproxy:fuzz_cfg_parser: Segv on unknown address in sanitize_for_printing

Project: https://github.com/haproxy/haproxy.git Detailed Report: https://oss-fuzz.com/testcase?key=6200407397564416 Project: haproxy Fuzzing Engine: libFuzzer Fuzz Target: fuzzcfgparser Job Type: libfuzzerasanhaproxy Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash Stat...

haproxy:fuzz_cfg_parser: Stack-buffer-overflow in parse_line

Project: https://github.com/haproxy/haproxy.git Detailed Report: https://oss-fuzz.com/testcase?key=4807914173038592 Project: haproxy Fuzzing Engine: honggfuzz Fuzz Target: fuzzcfgparser Job Type: honggfuzzasanhaproxy Platform Id: linux Crash Type: Stack-buffer-overflow READ 8 Crash Address:...

ROS-20250430-13

HAProxy server software vulnerability is related to bounds errors in regsub function in src/sample.c. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of denial of service...

Mageia: Security Advisory (MGASA-2025-0138)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated haproxy packages fix security vulnerability

BUG/MEDIUM: sample: fix risk of overflow when replacing multiple regex back-refsAleandro Prudenzano of Doyensec and Edoardo Geraci of Codean Labs reported a bug in sampleconvregsub, which can cause replacements of multiple back-references to overflow the temporary trash buffer. The problem happen...

MGASA-2025-0138 Updated haproxy packages fix security vulnerability

BUG/MEDIUM: sample: fix risk of overflow when replacing multiple regex back-refsAleandro Prudenzano of Doyensec and Edoardo Geraci of Codean Labs reported a bug in sampleconvregsub, which can cause replacements of multiple back-references to overflow the temporary trash buffer. The problem happen...

Ubuntu: Security Advisory (USN-7431-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-4135-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 4135-1] haproxy security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4135-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk April 23, 2025 https://wiki.debian.org/LTS -...

USN-7431-2 haproxy vulnerability

USN-7431-1 fixed a vulnerability in HAProxy. This update provides the corresponding update for Ubuntu 25.04. Original advisory details: Aleandro Prudenzano and Edoardo Geraci discovered that HAProxy incorrectly handled certain uncommon configurations that replace multiple short patterns with a...