CVE-2019-14241

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

HAProxy through 2.0.2 allows attackers to cause a denial of service (ha_panic) via vectors related to htx_manage_client_side_cookies in proto_htx.c.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00060.html
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00062.html
http://www.securityfocus.com/bid/109352Third Party Advisory, VDB Entry
https://github.com/haproxy/haproxy/issues/181Exploit, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00060.html
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00062.html
http://www.securityfocus.com/bid/109352Third Party Advisory, VDB Entry
https://github.com/haproxy/haproxy/issues/181Exploit, Third Party Advisory

Timeline

Published: Jul 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-142426.7An issue was discovered in Bitdefender products for Windows (Bitdefender Endpoint Security Tool versions prior to 6.6.8.115; and Bitdefender CVE-2019-142437.5headerv2.go in mastercactapus proxyprotocol before 0.0.2, as used in the mastercactapus caddy-proxyprotocol plugin through 0.0.2 for Caddy, CVE-2019-142456.5In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete databases (such as oa CVE-2019-142466.5In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to discover phpMyAdmin password CVE-2019-142475.5The scan() function in mad.c in mpg321 0.3.2 allows remote attackers to trigger an out-of-bounds write via a zero bitrate in an MP3 file.CVE-2019-142485.5In libnasm.a in Netwide Assembler (NASM) 2.14.xx, asm/pragma.c allows a NULL pointer dereference in process_pragma, search_pragma_list, and CVE-2019-142496.5dwarf_elf_load_headers.c in libdwarf before 2019-07-05 allows attackers to cause a denial of service (division by zero) via an ELF file with CVE-2019-14256.5An elevation of privilege vulnerability exists when Visual Studio fails to properly validate hardlinks while extracting archived files, aka CVE-2019-142505.5An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check CVE-2019-142517.5An issue was discovered in T24 in TEMENOS Channels R15.01. The login page presents JavaScript functions to access a document on the server o CVE-2019-142527.2An issue was discovered in the secure portal in Publisure 2.1.2. Once successfully authenticated as an administrator, one is able to inject CVE-2019-142536.5An issue was discovered in servletcontroller in the secure portal in Publisure 2.1.2. One can bypass authentication and perform a query on P