Description
HAProxy 1.4 before 1.4.24 and 1.5 before 1.5-dev19, when configured to use hdr_ip or other "hdr_*" functions with a negative occurrence count, allows remote attackers to cause a denial of service (negative array index usage and crash) via an HTTP header with a certain number of values, related to the MAX_HDR_HISTORY variable.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | haproxy | 1.4.24-1 | — |
| Debian 13 | haproxy | 1.4.24-1 | — |
| Debian 12 | haproxy | 1.4.24-1 | — |
| Debian 6.0 | haproxy | 1.4.8-1+squeeze1 | DSA-2711-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | haproxy | 1.4.22-5.el6_4 | RHSA-2013:1120 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 1 | haproxy | 1.4.22-6.el6op | RHSA-2013:1204 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | haproxy | 1.7.0-1.1 | openSUSE-SU-2024:10114-1 |
Advisories 4
- DSA-2711-1 haproxy - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10114-1 haproxy-1.7.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2013:1204 Red Hat Security Advisory: haproxy security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2013:1120 Red Hat Security Advisory: haproxy security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- RHSA-2013:1204 vendor-advisory
- [haproxy] 20130617 [ANNOUNCE] haproxy-1.5-dev19 and 1.4.24 (security update) mailing-list
- 54344 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=974259
- DSA-2711 vendor-advisory
- RHSA-2013:1120 vendor-advisory
- USN-1889-1 vendor-advisory