CVE-2024-45506
Fixed in a distro release EPSS 1%CVSS 7.5
HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.
Products: haproxy
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | haproxy-2.9 | 2.9.10-r0 |
| Chainguard | haproxy-2.9-doc | 2.9.10-r0 |
| Chainguard | haproxy-2.9-iamguarded-compat | 2.9.10-r0 |
| Chainguard | haproxy-2.9-oci-entrypoint | 2.9.10-r0 |
| Chainguard | haproxy-3.0 | 3.0.4-r0 |
| Chainguard | haproxy-3.0-doc | 3.0.4-r0 |
| Chainguard | haproxy-3.0-iamguarded-compat | 3.0.4-r0 |
| Chainguard | haproxy-3.0-nocaps | 3.0.4-r0 |
| Chainguard | haproxy-3.0-oci-entrypoint | 3.0.4-r0 |
| Debian 13 | haproxy | 2.9.10-1 |
| Debian 14 | haproxy | 2.9.10-1 |
| Ubuntu 20.04 LTS | haproxy | 2.0.33-0ubuntu0.1 |
| Ubuntu 22.04 LTS | haproxy | 2.4.24-0ubuntu0.22.04.1 |
| Ubuntu 24.04 LTS | haproxy | 2.8.5-1ubuntu3 |
| Wolfi | haproxy-2.9 | 2.9.10-r0 |
| Wolfi | haproxy-2.9-doc | 2.9.10-r0 |
| Wolfi | haproxy-2.9-oci-entrypoint | 2.9.10-r0 |
| Wolfi | haproxy-3.0 | 3.0.4-r0 |
| Wolfi | haproxy-3.0-doc | 3.0.4-r0 |
| Wolfi | haproxy-3.0-oci-entrypoint | 3.0.4-r0 |
| openSUSE Tumbleweed | haproxy | 3.0.4+git0.7a59afa93-1.1 |