Description
Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 (if cache enabled) allows attackers to achieve information disclosure via an unauthenticated remote request, related to the proto_http.c check_request_for_cacheability function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | haproxy | 1.8.9-2 | — |
| Debian 13 | haproxy | 1.8.9-2 | — |
| Debian 12 | haproxy | 1.8.9-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | haproxy | 1.8.8-1ubuntu0.1 | USN-3663-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | rh-haproxy18-haproxy +1 | 1.8.17-1.el7 | RHSA-2019:1436 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 | haproxy | 1.8.14~git0.52e4d43b-3.3.2 | SUSE-SU-2018:3249-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | haproxy | 2.4.4+git0.acb1d0bea-1.2 | openSUSE-SU-2024:10839-1 |
Advisories 4
- RHSA-2019:1436 Red Hat Security Advisory: rh-haproxy18-haproxy security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- USN-3663-1 haproxy vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:10839-1 haproxy-2.4.4+git0.acb1d0bea-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3249-1 Security update for haproxy SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 104347 vdb-entry
- USN-3663-1 vendor-advisory
- https://git.haproxy.org/?p=haproxy-1.8.git%3Ba=commit%3Bh=17514045e5d934dede62116216c1b016fe23dd06
- RHSA-2019:1436 vendor-advisory