Description
An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | haproxy | unknown | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | haproxy | 2.6.8-1 | — |
| Debian 13 | haproxy | 2.6.8-1 | — |
| Debian 12 | haproxy | 2.6.8-1 | — |
| Debian 11 | haproxy | 2.2.9-2+deb11u4 | DSA-5348-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | haproxy | 2.4.18-0ubuntu1.1 | USN-5819-1 |
| Ubuntu 20.04 LTS | haproxy | 2.0.29-0ubuntu1.1 | USN-5819-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | haproxy | 2.4.17-3.el9_1.2 | RHSA-2023:1696 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.0 EUS | haproxy | 2.4.7-2.el9_0.2 | RHSA-2023:1978 |
| Red Hat Openshift Ironic 4 | python-werkzeug +1 | 2.0.3-4.el9 | RHSA-2023:1325 |
| Red Hat OpenShift 4 | buildah +1 | 1:1.23.4-4.rhaos4.12.el8 | RHSA-2023:1325, RHSA-2023:0727 |
| Red Hat OpenShift 4 | conmon | 2:2.1.2-3.rhaos4.12.el8 | RHSA-2023:0727 |
| Red Hat OpenShift 4 | container-selinux | 2:2.188.0-2.rhaos4.12.el8 | RHSA-2023:0727 |
| Red Hat OpenShift 4 | containernetworking-plugins | 1.0.1-6.rhaos4.12.el8 | RHSA-2023:0727 |
| Red Hat OpenShift 4 | containers-common | 2:1-33.rhaos4.12.el8 | RHSA-2023:0727 |
| Red Hat OpenShift 4 | cri-o | 1.25.2-6.rhaos4.12.git3c4e50c.el8 | RHSA-2023:1325, RHSA-2023:0727 |
| Red Hat OpenShift 4 | crun | 1.4.2-2.rhaos4.12.el8 | RHSA-2023:0727 |
| Red Hat OpenShift 4 | fuse-overlayfs | 1.9-2.rhaos4.12.el8 | RHSA-2023:0727 |
| Red Hat OpenShift 4 | haproxy +1 | 2.2.15-6.el8 | RHSA-2023:1325, RHSA-2023:0727, RHBA-2023:1321 |
| Red Hat OpenShift 4 | kernel-rt +15 | 4.18.0-372.43.1.rt7.200.el8_6 | RHSA-2023:0727 |
| Red Hat OpenShift 4 | openshift +1 | 4.13.0-202304211155.p0.gb404935.assembly.stream.el8 | RHSA-2023:1325 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.12.0-202301312133.p0.gb05f7d4.assembly.stream.el8 | RHSA-2023:1325, RHSA-2023:0727 |
| Red Hat OpenShift 4 | podman +6 | 3:4.2.0-5.rhaos4.12.el9 | RHSA-2023:1325, RHSA-2023:0727 |
| Red Hat OpenShift 4 | python-werkzeug +1 | 1.0.1-3.el8ost | RHSA-2023:1325 |
| Red Hat OpenShift 4 | runc | 3:1.1.4-2.rhaos4.12.el8 | RHSA-2023:0727 |
| Red Hat OpenShift 4 | skopeo +1 | 2:1.9.4-2.rhaos4.12.el8 | RHSA-2023:1325, RHSA-2023:0727 |
| Red Hat OpenShift 4 | slirp4netns | 1.1.8-2.rhaos4.12.el8 | RHSA-2023:0727 |
| Red Hat OpenShift 4 | toolbox | 0.1.1-3.rhaos4.12.el8 | RHSA-2023:0727 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | haproxy | 2.4.17-3.el9_1.2 | ALSA-2023:1696 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | haproxy | 2.4.8+git0.d1f8d41e0-150400.3.6.1 | SUSE-SU-2023:0153-1 |
| SLES 15 SP3 | haproxy | 2.0.14-150200.11.15.1 | SUSE-SU-2023:0413-1, SUSE-FU-2023:2119-1 |
| SLES 15 SP2 | haproxy | 2.0.14-150200.11.15.1 | SUSE-SU-2023:0413-1, SUSE-FU-2023:2119-1 |
| SLES 15 SP1 | haproxy | 2.0.14-150100.8.27.1 | SUSE-SU-2023:0412-1, SUSE-FU-2023:2117-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 5.3 | haproxy | 2.4.8+git0.d1f8d41e0-150400.3.6.1 | SUSE-SU-2023:0153-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | haproxy | 2.4.8+git0.d1f8d41e0-150400.3.6.1 | SUSE-SU-2023:0153-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.3 | haproxy | 2.4.8+git0.d1f8d41e0-150400.3.6.1 | SUSE-SU-2023:0153-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | haproxy | 2.4.17-3.el9_1.2 | ELSA-2023-1696 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | haproxy-3.2 | 3.2.4-r1 | — |
| Wolfi rolling | haproxy-3.3 | 3.3.2-r0 | — |
Advisories 17
- ALSA-2023:1696 Moderate: haproxy security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2023:1325 Red Hat Security Advisory: OpenShift Container Platform 4.13.0 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:0727 Red Hat Security Advisory: OpenShift Container Platform 4.12.3 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- DSA-5348-1 haproxy - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-5819-1 haproxy vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-FU-2023:2117-1 Feature update for haproxy SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:0153-1 Security update for haproxy SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:0412-1 Security update for haproxy SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-FU-2023:2119-1 Feature update for haproxy SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:0413-1 Security update for haproxy SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2023:1978 Red Hat Security Advisory: haproxy security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2023:1696 Red Hat Security Advisory: haproxy security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHBA-2023:1321 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.9.58 packages update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHBA-2023:0898 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.10.53 packages update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHBA-2023:0773 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.11.28 packages update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- WID-SEC-2023-0097 HAProxy: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Jan 17, 2024
- ELSA-2023-1696 Moderate: haproxy security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Apr 11, 2023