4.8Medium
HAProxy HAProxy
HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.
haproxy aloha vulnerabilities (CVE)
CVE records published for haproxy aloha, newest first. Follow to get an email when a new one appears.
3.7Low
HAProxy HAProxy
HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.
7.5High
HAProxy - NULL Pointer Dereference in hpack_dht_insert Function
haproxy haproxy
HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can tr…
7.5High
HAProxy - Integer Overflow in FCGI Demux Record Length Field
haproxy haproxy
HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field…