Critical Denial of Service Vulnerability in HAProxy - USN-7431-2
Summary
USN-7431-2: haproxy vulnerability. Affects haproxy versions < 3.0.8-1ubuntu1.1. Fixed in 3.0.8-1ubuntu1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HAProxy is a widely-used open-source software that provides high availability, load balancing, and proxying for TCP and HTTP applications. It is known for its performance and reliability, making it a popular choice for managing web traffic. However, certain uncommon configurations can lead to vulnerabilities, as highlighted by the recent security issues.
Vulnerability Detail
The vulnerability identified in HAProxy arises from its improper handling of specific configurations that replace multiple short patterns with a longer one. Discovered by Aleandro Prudenzano and Edoardo Geraci, this flaw allows a remote attacker to exploit the issue, potentially causing HAProxy to crash, leading to a denial of service. In some cases, this could also allow for arbitrary code execution, posing a significant risk to systems using the affected version.
How To Fix
Minimum fixed version
3.0.8-1ubuntu1.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade haproxyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider disabling certain configurations that are known to trigger the vulnerability until the patch can be applied. However, it is recommended to apply the update as soon as possible to mitigate risks.
Conclusion
The vulnerability in HAProxy poses significant risks, including denial of service and potential arbitrary code execution. It is crucial for users to update to the patched version promptly and consider temporary workarounds to mitigate risks until the update can be applied.
See every vulnerability recorded for haproxy →
FAQ
The vulnerability allows for denial of service and potentially arbitrary code execution due to improper handling of specific configurations.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Consider disabling the configurations that are known to trigger the vulnerability as a temporary workaround until you can apply the update.
Failing to address this vulnerability could lead to service interruptions or unauthorized access to your systems, compromising security and availability.
You can refer to the original advisory details provided in USN-7431-1 and the related CVE-2025-32464 for more comprehensive information.
References
Related vulnerabilities
Recent vulnerabilities recorded for haproxy.
