CVE-2024-53008
Fixed in a distro release EPSS 1%CVSS 5.3
Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remote attacker may access a path that is restricted by ACL (Access Control List) set on the product. As a result, the attacker may obtain sensitive information.
Products: HAProxy Project HAProxy 2.6, HAProxy Project HAProxy 2.8, HAProxy Project HAProxy 2.9, HAProxy Project HAProxy 3.0, haproxy
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | haproxy | 2.8.3-1.amzn2023.0.1 |
| Chainguard | haproxy-2.6 | 2.6.20-r0 |
| Chainguard | haproxy-2.8 | 2.8.13-r0 |
| Debian 12 | haproxy | no fix |
| Debian 13 | haproxy | 2.9.10-1 |
| Debian 14 | haproxy | 2.9.10-1 |
| SUSE Linux Enterprise High Availability Extension 15 SP6 | haproxy | 2.8.11+git0.01c1056a4-150600.3.3.1 |
| SUSE Linux Micro 6.0 | haproxy | 2.8.11+git0.01c1056a4-1.1 |
| SUSE Linux Micro 6.1 | haproxy | 2.8.11+git0.01c1056a4-slfo.1.1_1.1 |
| Ubuntu 24.04 LTS | haproxy | 2.8.5-1ubuntu3.2 |
| openSUSE Leap 15.6 | haproxy | 2.8.11+git0.01c1056a4-150600.3.3.1 |