Description
HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | haproxy | 2.6.15-1 | — |
| Debian 13 | haproxy | 2.6.15-1 | — |
| Debian 12 | haproxy | 2.6.12-1+deb12u1 | DSA-5590-1 |
| Debian 11 | haproxy | 2.2.9-2+deb11u6 | DSA-5590-1 |
| Debian 10 | haproxy | 1.8.19-1+deb10u5 | DLA-3688-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | haproxy | 2.4.22-0ubuntu0.22.04.3 | USN-6530-1 |
| Ubuntu 20.04 LTS | haproxy | 2.0.31-0ubuntu0.3 | USN-6530-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | haproxy | 1.8.8-1ubuntu0.13+esm2 | USN-6530-2 |
| Ubuntu Pro 16.04 LTS | haproxy | 1.6.3-1ubuntu0.3+esm1 | USN-6530-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | haproxy | 2.4.22-3.el9_3 | RHSA-2024:1142 |
| RHEL 8 | haproxy | 1.8.27-5.el8_10.1 | RHSA-2024:8849 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 EUS | haproxy | 2.4.17-6.el9_2.2 | RHSA-2024:1089 |
| RHEL 8.8 EUS | haproxy | 1.8.27-5.el8_8.1 | RHSA-2024:10267 |
| RHEL 8.6 TUS | haproxy | 1.8.27-4.el8_6.1 | RHSA-2024:8874 |
| RHEL 8.6 E4S | haproxy | 1.8.27-4.el8_6.1 | RHSA-2024:8874 |
| RHEL 8.6 AUS | haproxy | 1.8.27-4.el8_6.1 | RHSA-2024:8874 |
| RHEL 8.4 TUS | haproxy | 1.8.27-2.el8_4.1 | RHSA-2024:10271 |
| RHEL 8.4 E4S | haproxy | 1.8.27-2.el8_4.1 | RHSA-2024:10271 |
| RHEL 8.4 AUS | haproxy | 1.8.27-2.el8_4.1 | RHSA-2024:10271 |
| RHEL 8.2 AUS | haproxy | 1.8.23-3.el8_2.1 | RHSA-2024:9945 |
| Red Hat OpenShift 4 | haproxy +1 | 2.6.13-4.rhaos4.14.el8 | RHSA-2024:6412, RHSA-2024:4853 |
| Red Hat OpenShift 4 | openshift +1 | 4.14.0-202409041843.p0.g03a907c.assembly.stream.el8 | RHSA-2024:6412 |
| Red Hat OpenShift 4 | podman +6 | 3:4.4.1-26.2.rhaos4.15.el8 | RHSA-2024:4853 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | haproxy | 2.4.22-3.el9_3 | ALSA-2024:1142 |
| AlmaLinux 8 | haproxy | 1.8.27-5.el8_10.1 | ALSA-2024:8849 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | haproxy | 1.8.27-5.el8_10.1 | RLSA-2024:8849 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | haproxy | 2.4.22+git0.f8e3218e2-150400.3.19.1 | SUSE-SU-2023:4647-1 |
| SLES 15 SP4 | haproxy | 2.4.22+git0.f8e3218e2-150400.3.19.1 | SUSE-SU-2023:4647-1 |
| SLES 15 SP3 | haproxy | 2.0.31-150200.11.26.1 | SUSE-SU-2023:4645-1 |
| SLES 15 SP2 | haproxy | 2.0.31-150200.11.26.1 | SUSE-SU-2023:4645-1 |
| SLES 15 SP1 | haproxy | 2.0.31-150100.8.34.1 | SUSE-SU-2023:4646-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 5.5 | haproxy | 2.4.22+git0.f8e3218e2-150400.3.19.1 | SUSE-SU-2024:2377-1, SUSE-SU-2023:4647-1 |
| SLE Micro 5.4 | haproxy | 2.4.22+git0.f8e3218e2-150400.3.19.1 | SUSE-SU-2023:4647-1 |
| SLE Micro 5.3 | haproxy | 2.4.22+git0.f8e3218e2-150400.3.19.1 | SUSE-SU-2023:4647-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.5 | haproxy | 2.4.22+git0.f8e3218e2-150400.3.19.1 | SUSE-SU-2023:4647-1 |
| openSUSE Leap 15.4 | haproxy | 2.4.22+git0.f8e3218e2-150400.3.19.1 | SUSE-SU-2023:4647-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.4 | haproxy | 2.4.22+git0.f8e3218e2-150400.3.19.1 | SUSE-SU-2023:4647-1 |
| openSUSE Leap Micro 5.3 | haproxy | 2.4.22+git0.f8e3218e2-150400.3.19.1 | SUSE-SU-2023:4647-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | haproxy | 2.8.3-1.amzn2023 | ALAS2023-2024-496 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | haproxy | 2.4.24-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | haproxy | 2.4.22-3.el9_3 | ELSA-2024-1142 |
| Oracle Linux 8 | haproxy | 1.8.27-5.el8_10.1 | ELSA-2024-8849 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
slicingmelon/HAProxy-CVE-2023-45539-PoC ★ 0 · Aug 27, 2025
HAProxy-CVE-2023-45539-PoC
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 24
- ALSA-2024:1142 Moderate: haproxy security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:8849 Moderate: haproxy security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:4853 Red Hat Security Advisory: OpenShift Container Platform 4.15.24 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:1142 Red Hat Security Advisory: haproxy security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2024:1089 Red Hat Security Advisory: haproxy security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2024:6412 Red Hat Security Advisory: OpenShift Container Platform 4.14.36 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-6530-2 haproxy vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- RHSA-2024:10267 Red Hat Security Advisory: haproxy security update Red Hat Security Advisories (RHSA) · Mar 18, 2026
- RHSA-2024:10271 Red Hat Security Advisory: haproxy security update Red Hat Security Advisories (RHSA) · Mar 18, 2026
- RHSA-2024:9945 Red Hat Security Advisory: haproxy security update Red Hat Security Advisories (RHSA) · Mar 18, 2026
- RHSA-2024:8874 Red Hat Security Advisory: haproxy security update Red Hat Security Advisories (RHSA) · Mar 18, 2026
- RHSA-2024:8849 Red Hat Security Advisory: haproxy security update Red Hat Security Advisories (RHSA) · Mar 18, 2026
- DSA-5590-1 haproxy - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3688-1 haproxy - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-6530-1 haproxy vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- RLSA-2024:8849 Moderate: haproxy security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2023:4647-1 Security update for haproxy SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4645-1 Security update for haproxy SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4646-1 Security update for haproxy SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2377-1 Security update for haproxy SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-3019 HAProxy Enterprise: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Aug 26, 2025
- ELSA-2024-8849 Moderate: haproxy security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 5, 2024
- ELSA-2024-1142 Moderate: haproxy security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Mar 6, 2024
- ALAS2023-2024-496 Moderate: haproxy security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jan 22, 2024
References
- https://lists.w3.org/Archives/Public/ietf-http-wg/2023JulSep/0070.html
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=2eab6d354322932cfec2ed54de261e4347eca9a6
- https://www.mail-archive.com/haproxy%40formilux.org/msg43861.html
- [debian-lts-announce] 20231214 [SECURITY] [DLA 3688-1] haproxy security update mailing-list