HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| HAProxy | HAProxy | 3.0.0 – < 3.0.30, 3.2.0 – < 3.2.26, 3.3.0 – < 3.3.17, 3.4.0 – < 3.4.6, 3.5-dev – < 3.5-dev9 | |
| HAProxy | HAProxy Enterprise Edition | 3.0r1 – < 3.0r1-362.1441, 3.2r1 – < 3.2r1-378.1259, 3.3r1 – < 3.3r1-377.1005 | |
| HAProxy Technologies | HAProxy Kubernetes Ingress Controller | 3.2.0 – < 3.2.17 | |
| HAProxy Technologies | Kubernetes Ingress Controller Enterprise | 3.2.0 – < 3.2.17-ee1, 3.0 – < 3.0.16-ee17, 1.11 – < 1.11.14-ee11 |
Unser kostenloser Open-Source-Honeypot wartet auf Ports, die Ihr Server nicht nutzt, und meldet verbindende Scanner und Angreifer an eine gemeinsame Blockliste.
