Description
The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | haproxy | 1.5.14-1 | — |
| Debian 13 | haproxy | 1.5.14-1 | — |
| Debian 12 | haproxy | 1.5.14-1 | — |
| Debian 8 | haproxy | 1.5.8-3+deb8u1 | DSA-3301-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | haproxy | 1.5.4-4.el7_1.1 | RHSA-2015:1741 |
| RHEL 6 | haproxy | 1.5.4-2.el6_7.1 | RHSA-2015:1741 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 2 | haproxy15side | 1.5.4-2.el6op | RHSA-2015:2666 |
| Red Hat OpenShift 2 | openshift-enterprise-release +4 | 2.2.8-1.el6op | RHSA-2015:2666 |
| Red Hat OpenShift 2 | openshift-origin-broker-util | 1.37.4.2-1.el6op | RHSA-2015:2666 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-haproxy | 1.31.4.1-1.el6op | RHSA-2015:2666 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-jbosseap | 2.27.3.1-1.el6op | RHSA-2015:2666 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-jbossews | 1.35.3.2-1.el6op | RHSA-2015:2666 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-python | 1.34.1.1-1.el6op | RHSA-2015:2666 |
| Red Hat OpenShift 2 | openshift-origin-node-util | 1.38.5.1-1.el6op | RHSA-2015:2666 |
| Red Hat OpenShift 2 | rhc | 1.38.4.5-1.el6op | RHSA-2015:2666 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-common | 1.29.4.1-1.el6op | RHSA-2015:2666 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-controller | 1.38.4.2-1.el6op | RHSA-2015:2666 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-node | 1.38.4.1-1.el6op | RHSA-2015:2666 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-routing-daemon | 0.26.4.4-1.el6op | RHSA-2015:2666 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | haproxy | 1.5.4-2.4.1 | SUSE-SU-2015:1663-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 5 | haproxy | 1.5.4-12.1 | SUSE-SU-2015:1776-1 |
| SUSE Cloud Compute Node for SUSE Linux Enterprise 12 | haproxy | 1.5.4-2.4.1 | SUSE-SU-2015:1663-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | haproxy | 1.7.0-1.1 | openSUSE-SU-2024:10114-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | haproxy | 1.5.4-4.el7_1.1 | ELSA-2015-1741 |
Advisories 7
- RHSA-2015:2666 Red Hat Security Advisory: Red Hat OpenShift Enterprise 2.2.8 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2015:1741 Red Hat Security Advisory: haproxy security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- DSA-3301-1 haproxy - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10114-1 haproxy-1.7.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:1663-1 Security update for haproxy SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:1776-1 Security update for haproxy SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2015-1741 Important: haproxy security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Sep 8, 2015
References
- RHSA-2015:1741 vendor-advisory
- openSUSE-SU-2015:1831 vendor-advisory
- http://www.haproxy.org/news.html
- RHSA-2015:2666 vendor-advisory
- USN-2668-1 vendor-advisory
- SUSE-SU-2015:1663 vendor-advisory
- http://git.haproxy.org/?p=haproxy-1.5.git%3Ba=commit%3Bh=7ec765568883b2d4e5a2796adbeb492a22ec9bd4
- DSA-3301 vendor-advisory
- 75554 vdb-entry