Remote Denial of Service Vulnerability in HAProxy - CVE-2024-45506
Summary
DEBIAN-CVE-2024-45506: HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in... Affects haproxy versions < 2.9.10-1. Fixed in 2.9.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HAProxy is a widely used open-source software that provides high availability, load balancing, and proxying for TCP and HTTP-based applications. It is known for its performance and reliability, making it a popular choice for managing web traffic. However, certain versions of HAProxy are vulnerable to a remote denial of service attack, which can disrupt service availability under specific conditions.
Vulnerability Detail
The vulnerability identified as CVE-2024-45506 affects HAProxy versions 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6. It allows a remote attacker to exploit the HTTP/2 zero-copy forwarding feature, leading to a denial of service condition. This issue has been actively exploited in the wild, emphasizing the urgency of addressing it. The root cause lies in the h2_send loop, which can be triggered under certain conditions, resulting in service disruption.
How To Fix
Minimum fixed version
2.9.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade haproxyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable HTTP/2 support in HAProxy configurations until the package is updated. This can be done by modifying the HAProxy configuration file (usually located at /etc/haproxy/haproxy.cfg) and removing or commenting out the 'http2' directive.
Conclusion
In summary, CVE-2024-45506 is a critical vulnerability in specific versions of HAProxy that can lead to remote denial of service. Users are strongly advised to update to the latest patched versions to mitigate the risk. Additionally, temporary workarounds are available to help maintain service availability until updates can be applied.
See every vulnerability recorded for haproxy →
FAQ
CVE-2024-45506 is a vulnerability in HAProxy that allows remote denial of service through the HTTP/2 zero-copy forwarding feature.
The affected versions are HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to a denial of service, causing disruptions in service availability for users.
As a temporary measure, you can disable HTTP/2 support in your HAProxy configuration until you can apply the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for haproxy.
