p PatchFirst

CVE-2024-53008

CVE-2024-53008

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remote attacker may access a path that is restricted by ACL (Access Control List) set on the product. As a result, the attacker may obtain sensitive information.

CVSS 5.3 · Medium · EPSS 1.0% · Fix available

Published
Updated

Stack: system · web

Affected products and versions

  • haproxy 2.6

    Versions
    • 2.6.18 and earlier: Affected

    No fix published

  • haproxy 2.8

    Versions
    • 2.8.10 and earlier: Affected

    No fix published

  • haproxy 2.9

    Versions
    • 2.9.9 and earlier: Affected

    No fix published

  • haproxy 3.0

    Versions
    • 3.0.2 and earlier: Affected

    No fix published

  • haproxy Debian:12

    Versions
    • 2.6.12-1
    • 2.6.12-1+deb12u1
    • 2.6.12-1+deb12u2
    • 2.6.12-1+deb12u3
    • 2.6.13-1
    • 2.6.14-1
    • 2.6.15-1
    • 2.7.0-1
    • 2.7.1-1
    • 2.7.2-1
    • 2.7.2-2
    • 2.7.3-1
    • 2.7.4-1
    • 2.7.5-1
    • 2.7.6-1
    • 2.7.7-1
    • 2.7.8-1
    • 2.8.0-1
    • 2.8.1-1
    • 2.8.2-1
    • 2.8.3-1
    • 2.8.4-1
    • 2.8.4-2
    • 2.8.5-1
    • 2.9.0-1
    • 2.9.1-1
    • 2.9.10-1
    • 2.9.11-1
    • 2.9.12-1
    • 2.9.2-1
    • 2.9.3-1
    • 2.9.4-1
    • 2.9.5-1
    • 2.9.6-1
    • 2.9.7-1
    • 2.9.8-1
    • 2.9.9-1
    • 3.0.0-1
    • 3.0.1-1
    • 3.0.10-1
    • 3.0.11-1
    • 3.0.2-1
    • 3.0.3-1
    • 3.0.4-1
    • 3.0.5-1
    • 3.0.6-1
    • 3.0.6-2
    • 3.0.6-3
    • 3.0.7-1
    • 3.0.8-1
    • 3.0.9-1
    • 3.1.0-1
    • 3.1.0-2
    • 3.1.1-1
    • 3.1.2-1
    • 3.1.3-1
    • 3.1.5-1
    • 3.1.6-1
    • 3.1.7-1
    • 3.2.0-1
    • 3.2.1-1
    • 3.2.10-1
    • 3.2.11-1
    • 3.2.11-2
    • 3.2.12-1
    • 3.2.13-1
    • 3.2.14-1
    • 3.2.15-1
    • 3.2.16-1
    • 3.2.17-1
    • 3.2.18-1
    • 3.2.19-1
    • 3.2.20-1
    • 3.2.21-1
    • 3.2.22-1
    • 3.2.23-1
    • 3.2.3-1
    • 3.2.3-2
    • 3.2.4-1
    • 3.2.5-1
    • 3.2.5-2
    • 3.2.6-1
    • 3.2.7-1
    • 3.2.8-1
    • 3.2.9-1
    • 3.3.0-1
    • 3.3.1-1
    • 3.3.10-1
    • 3.3.2-1
    • 3.3.2-2
    • 3.3.3-1
    • 3.3.4-1
    • 3.3.5-1
    • 3.3.6-1
    • 3.3.7-1
    • 3.3.8-1
    • 3.3.9-1
    • 3.4.0-1
    • 3.4.1-1
    • 3.4.2-1
    • 3.4.3-1
    • 3.4.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • haproxy Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.9.10-1

    Update to 2.9.10-1

  • haproxy Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.9.10-1

    Update to 2.9.10-1

  • haproxy Ubuntu:24.04:LTS

    Versions
    • 2.6.15-1ubuntu2
    • 2.8.5-1ubuntu1
    • 2.8.5-1ubuntu2
    • 2.8.5-1ubuntu3
    • 2.8.5-1ubuntu3.1
    Affected ranges
    • ECOSYSTEM: < 2.8.5-1ubuntu3.2

    Update to 2.8.5-1ubuntu3.2

Original sources

Check your server →