Description
A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | haproxy | 2.5.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | haproxy | 2.4.13-1 | — |
| Debian 13 | haproxy | 2.4.13-1 | — |
| Debian 12 | haproxy | 2.4.13-1 | — |
| Debian 11 | haproxy | 2.2.9-2+deb11u3 | DSA-5102-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | haproxy | 2.0.13-2ubuntu0.5 | USN-5312-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | haproxy +1 | 2.0.16-3.el7 | RHSA-2022:1620, RHSA-2022:1336, RHSA-2022:1153 |
| Red Hat OpenShift 4 | haproxy22 | 2.2.13-3.el8 | RHSA-2022:1153, RHSA-2022:1021 |
| Red Hat OpenShift 4 | jenkins-2-plugins | 4.6.1650364520-1.el8 | RHSA-2022:1620, RHSA-2022:1021 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | haproxy | 2.4.8+git0.d1f8d41e0-150400.3.3.13 | SUSE-SU-2022:2277-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | haproxy | 2.5.4+git0.e55ab4208-1.1 | openSUSE-SU-2024:11876-1 |
| openSUSE Leap 15.4 | haproxy | 2.4.8+git0.d1f8d41e0-150400.3.3.13 | SUSE-SU-2022:2277-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.13 | haproxy | 2.2.21-r0 | — |
| Alpine v3.12 | haproxy | 2.2.21-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | haproxy | 2.4.13-1 | — |
Advisories 9
- RHSA-2022:1021 Red Hat Security Advisory: OpenShift Container Platform 4.9.26 security update Red Hat Security Advisories (RHSA) · Mar 21, 2026
- RHSA-2022:1620 Red Hat Security Advisory: OpenShift Container Platform 4.6.57 packages and security update Red Hat Security Advisories (RHSA) · Mar 21, 2026
- DSA-5102-1 haproxy - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-5312-1 haproxy vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:11876-1 haproxy-2.5.4+git0.e55ab4208-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2277-1 Security update for haproxy SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2022:1336 Red Hat Security Advisory: OpenShift Container Platform 4.7.49 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2022:1153 Red Hat Security Advisory: OpenShift Container Platform 4.8.36 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- WID-SEC-2023-2455 Red Hat OpenShift: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 27, 2023