2636 matches found
CVE-2026-5501
wolfSSLX509verifycert in the OpenSSL compatibility layer accepts a certificate chain in which the leaf's signature is not checked, if the attacker supplies an untrusted intermediate with Basic Constraints CA:FALSE that is legitimately signed by a trusted root. An attacker who obtains any leaf...
haproxy-3.3.6+git91.af5637e93-1.1 on GA media (moderate)
haproxy-3.3.6+git91.af5637e93-1.1 on GA media Announcement ID: openSUSE-SU-2026:10581-1 Rating: moderate Cross-References: CVE-2026-33555 CVSS scores: CVE-2026-33555 SUSE : 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N CVE-2026-33555 SUSE : 6.3...
CVE-2026-33431 Roxy-WI Vulnerable to Authenticated Arbitrary File Read via Path Traversal in Config Version Viewer
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the POST /config//show API endpoint accepts a configver parameter that is directly appended to a base directory path to construct a local file path, which is subsequently opened and it...
haproxy:fuzz_h1_htx: Memcpy-param-overlap in htx_replace_blk_value
Project: https://github.com/haproxy/haproxy.git Detailed Report: https://oss-fuzz.com/testcase?key=5133738328784896 Project: haproxy Fuzzing Engine: honggfuzz Fuzz Target: fuzzh1htx Job Type: honggfuzzasanhaproxy Platform Id: linux Crash Type: Memcpy-param-overlap Crash Address:...
Roxy-WI 安全漏洞
Roxy-WI is an open-source web interface designed for managing Haproxy, Nginx, and Keepalived servers. Roxy-WI versions 8.2.8.2 and earlier contain security vulnerabilities. These vulnerabilities stem from the lack of escaping special characters in usernames during LDAP authentication, which could...
OPENSUSE-SU-2026:10581-1 haproxy-3.3.6+git91.af5637e93-1.1 on GA media
These are all security issues fixed in the haproxy-3.3.6+git91.af5637e93-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-33845
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the POST /config//show API endpoint accepts a configver parameter that is directly appended to a base directory path to construct a local file path, which is subsequently opened and it...
PT-2026-33846
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions up to and including 8.2.8.2, when LDAP authentication is enabled, Roxy-WI constructs an LDAP search filter by directly concatenating the user-supplied login username into the filter string without...
haproxy: HAProxy: Request smuggling via HTTP/3 parser desynchronization
A flaw was found in HAProxy. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/3 request. The HTTP/3 parser fails to verify that the received body length matches the announced content-length when a stream is closed with an empty payload. This desynchronization...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: haproxy: haproxy-3.0.19-1.1.hum1 aarch64, x8664 haproxy-3.0.19-1.1.hum1.src src...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: haproxy: haproxy-3.0.19-1.hum1 aarch64, x8664 haproxy-3.0.19-1.hum1.src src...
CLSA-2026-1776337242 haproxy: Fix of CVE-2019-18277
CVE-2019-18277: reject messages where "chunked" is missing from transfer-encoding...
haproxy: Fix of CVE-2019-18277
CVE-2019-18277: reject messages where "chunked" is missing from transfer-encoding...
CLSA-2026-1776343034 haproxy: Fix of CVE-2023-45539
CVE-2023-45539: reject '' as part of the URI to prevent ACL bypass via pathend rules...
CLSA-2026-1776342757 haproxy: Fix of CVE-2023-45539
CVE-2023-45539: reject '' as part of the URI to prevent ACL bypass via pathend rules...
CLSA-2026-1776336742 haproxy: Fix of CVE-2019-18277
CVE-2019-18277: reject messages where "chunked" is missing from transfer-encoding...
SUSE CVE-2026-33555
An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be...
CVE-2026-33555
A flaw was found in HAProxy. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/3 request. The HTTP/3 parser fails to verify that the received body length matches the announced content-length when a stream is closed with an empty payload. This desynchronization...
CVE-2026-33555
An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be...
AZL-82730 CVE-2026-33555 affecting package haproxy for versions less than 2.9.11-5
An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be...