Description
QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | haproxy | 2.9.11-1 | — |
| Debian 13 | haproxy | 2.9.11-1 | — |
| Debian 12 | haproxy | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | haproxy | 3.0.5+git0.8e879a52e-2.1 | openSUSE-SU-2024:14402-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | haproxy | 2.4.24-1 | — |
Advisories 2
- openSUSE-SU-2024:14402-1 haproxy-3.0.5+git0.8e879a52e-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-3157 HAProxy Enterprise: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Oct 16, 2024
References
- https://www.haproxy.org/download/3.1/src/CHANGELOG
- https://github.com/haproxy/haproxy/commit/f627b9272bd8ffca6f2f898bfafc6bf0b84b7d46
- https://www.mail-archive.com/haproxy%40formilux.org/msg45291.html
- https://www.mail-archive.com/haproxy%40formilux.org/msg45314.html
- https://www.mail-archive.com/haproxy%40formilux.org/msg45315.html
- https://www.haproxy.org/download/3.0/src/CHANGELOG
- https://www.haproxy.org/download/2.9/src/CHANGELOG