Description
Multiple integer overflows in the http_request_forward_body function in proto_http.c in HAProxy 1.5-dev23 before 1.5.4 allow remote attackers to cause a denial of service (crash) via a large stream of data, which triggers a buffer overflow and an out-of-bounds read.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | haproxy | 1.5.4-1 | — |
| Debian 13 | haproxy | 1.5.4-1 | — |
| Debian 12 | haproxy | 1.5.4-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | haproxy | 1.5.2-3.el7_0 | RHSA-2014:1292 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | haproxy | 1.7.0-1.1 | openSUSE-SU-2024:10114-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | haproxy | 1.5.2-3.el7_0 | ELSA-2014-1292 |
Advisories 3
- openSUSE-SU-2024:10114-1 haproxy-1.7.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2014:1292 Red Hat Security Advisory: haproxy security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ELSA-2014-1292 Moderate: haproxy security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Sep 24, 2014
References
- [haproxy] 20140805 segfault in http_skip_chunk_crlf after 16G of data has passed through haproxy mailing-list
- 61507 third-party-advisory
- 59936 third-party-advisory
- http://git.haproxy.org/?p=haproxy-1.5.git%3Ba=commitdiff%3Bh=b4d05093bc89f71377230228007e69a1434c1a0c
- [haproxy] 20140902 [ANNOUNCE] haproxy-1.5.4 mailing-list
- [oss-security] 20140909 Re: CVE Request: haproxy read out of bounds mailing-list
- RHSA-2014:1292 vendor-advisory