CVE-2023-44487

A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RSTSTREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any...

CVE-2023-44487 vulnerabilities

Vulnerabilities for packages: prometheus-adapter-fips, terraform-provider-sendgrid-fips, vault-k8s-fips, weaviate, wireguard-go, tomcat, nfs-subdir-external-provisioner-fips, gobuster, pulumi-language-java, terraform-provider-azurerm, gomplate, bank-vaults-fips, timestamp-authority-fips, cosign,...

Huawei EulerOS: Security Advisory for haproxy (EulerOS-SA-2023-2897)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for haproxy (EulerOS-SA-2023-2878)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Important: haproxy2

Issue Overview: HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and...

Medium: haproxy2

Issue Overview: HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind...

Medium: haproxy2

Issue Overview: A flaw was found in haproxy. An input validation flaw when processing HTTP/2 requests causes haproxy to not ensure that the scheme and path portions of a URI have the expected characters. This may cause specially crafted input to bypass implemented security restrictions. The highe...

Oracle Linux 8 : haproxy (ELSA-2020-1725)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-1725 advisory. - Fix hapack zero byte input causing overwrite CVE-2020-11100, 1819519 Tenable has extracted the preceding description block directly from the Oracle...

Huawei EulerOS: Security Advisory for haproxy (EulerOS-SA-2023-2687)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for haproxy (EulerOS-SA-2023-2645)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CBL Mariner 2.0 Security Update: haproxy (CVE-2023-40225)

The version of haproxy installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-40225 advisory. - HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x...

SUSE SLES15 Security Update : haproxy (SUSE-SU-2023:3490-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2023:3490-1 advisory. - CVE-2023-40225: Fixed request smuggling with empty content-length header value bsc1214102. Tenable has extracted the preceding description block...

CVE-2024-49214 affecting package haproxy for versions less than 2.4.24-1

CVE-2024-49214 affecting package haproxy for versions less than 2.4.24-1. A patched version of the package is available...

CVE-2023-45539 affecting package haproxy for versions less than 2.4.24-1

CVE-2023-45539 affecting package haproxy for versions less than 2.4.24-1. A patched version of the package is available...

CVE-2023-40225 affecting package haproxy for versions less than 2.4.24-1

CVE-2023-40225 affecting package haproxy for versions less than 2.4.24-1. An upgraded version of the package is available that resolves this issue...

SUSE-SU-2023:3490-1 Security update for haproxy

This update for haproxy fixes the following issues: - CVE-2023-40225: Fixed request smuggling with empty content-length header value bsc1214102...

SUSE SLES15 / openSUSE 15 Security Update : haproxy (SUSE-SU-2023:3469-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:3469-1 advisory. - CVE-2023-40225: Fixed request smuggling with empty content-length header value bsc1214102. Tenable has extracted the preceding descripti...

SUSE-SU-2023:3469-1 Security update for haproxy

This update for haproxy fixes the following issues: - CVE-2023-40225: Fixed request smuggling with empty content-length header value bsc1214102...

Medium: haproxy

Issue Overview: HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind...

Amazon Linux 2023 : haproxy (ALAS2023-2023-293)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-293 advisory. HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers,...