Description
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.
Metrics
CVSS 3.1 9.8/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- https://git.haproxy.org/?p=haproxy-2.0.git%3Ba=commit%3Bh=ac198b92d461515551b95daae20954b3053ce87e
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=146f53ae7e97dbfe496d0445c2802dd0a30b0878
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=54f53ef7ce4102be596130b44c768d1818570344
- https://seclists.org/bugtraq/2019/Nov/45Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202004-01
- https://tools.ietf.org/html/rfc7540#section-10.3Third Party Advisory
- https://usn.ubuntu.com/4212-1/Third Party Advisory
- https://www.debian.org/security/2019/dsa-4577Third Party Advisory
- https://git.haproxy.org/?p=haproxy-2.0.git%3Ba=commit%3Bh=ac198b92d461515551b95daae20954b3053ce87e
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=146f53ae7e97dbfe496d0445c2802dd0a30b0878
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=54f53ef7ce4102be596130b44c768d1818570344
- https://seclists.org/bugtraq/2019/Nov/45Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202004-01
- https://tools.ietf.org/html/rfc7540#section-10.3Third Party Advisory
- https://usn.ubuntu.com/4212-1/Third Party Advisory
- https://www.debian.org/security/2019/dsa-4577Third Party Advisory
Timeline
- Published
- Nov 27, 2019
- Last modified
- Jun 17, 2026
- NVD status
- Modified