CVE-2013-1912
Buffer overflow in HAProxy 1.4 through 1.4.22 and 1.5-dev through 1.5-dev17, when HTTP keep-alive...
CVE-2013-1912 is a medium vulnerability (CVSS 5.1) in Haproxy, published April 10, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.57%, the 92nd percentile. Fixed in haproxy 1.4.23-1.
Buffer overflow in HAProxy 1.4 through 1.4.22 and 1.5-dev through 1.5-dev17, when HTTP keep-alive is enabled, using HTTP keywords in TCP inspection rules, and running with rewrite rules that appends to requests, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted pipelined HTTP requests that prevent request realignment from occurring.
Exploit likelihood
What each source reports
NVD Score used
Buffer overflow in HAProxy 1.4 through 1.4.22 and 1.5-dev through 1.5-dev17, when HTTP keep-alive is enabled, using HTTP keywords in TCP inspection rules, and running with rewrite rules that appends to requests, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted pipelined HTTP requests that prevent request realignment from occurring.
- Record
CVE-2013-1912- CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Buffer overflow in HAProxy 1.4 through 1.4.22 and 1.5-dev through 1.5-dev17, when HTTP keep-alive is enabled, using HTTP keywords in TCP inspection rules, and running with rewrite rules that appends to requests, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted pipelined HTTP requests that prevent request realignment from occurring.
- Record
CVE-2013-1912- Updated
- 2026-11-02
EUVDEUVD-2013-1906 No score
Buffer overflow in HAProxy 1.4 through 1.4.22 and 1.5-dev through 1.5-dev17, when HTTP keep-alive is enabled, using HTTP keywords in TCP inspection rules, and running with rewrite rules that appends to requests, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted pipelined HTTP requests that prevent request realignment from occurring.
- Record
EUVD-2013-1906- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xgv2-5whc-jjqv No score
Buffer overflow in HAProxy 1.4 through 1.4.22 and 1.5-dev through 1.5-dev17, when HTTP keep-alive...
Buffer overflow in HAProxy 1.4 through 1.4.22 and 1.5-dev through 1.5-dev17, when HTTP keep-alive is enabled, using HTTP keywords in TCP inspection rules, and running with rewrite rules that appends to requests, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted pipelined HTTP requests that prevent request realignment from occurring.
- Record
GHSA-xgv2-5whc-jjqv- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Buffer overflow in HAProxy 1.4 through 1.4.22 and 1.5-dev through 1.5-dev17, when HTTP keep-alive is enabled, using HTTP keywords in TCP inspection rules, and running with rewrite rules that appends to requests, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted pipelined HTTP requests that prevent request realignment from occurring.
- Record
CVE-2013-1912- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-1912 No score
Buffer overflow in HAProxy 1.4 through 1.4.22 and 1.5-dev through 1.5-dev17, when HTTP keep-alive is enabled, using HTTP keywords in TCP inspection rules, and running with rewrite rules that appends to requests, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted pipelined HTTP requests that prevent request realignment from occurring.
- Record
DEBIAN-CVE-2013-1912- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10114-1 No score
haproxy-1.7.0-1.1 on GA media
These are all security issues fixed in the haproxy-1.7.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10114-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
haproxyDebian:12 |
before 1.4.23-1 | 1.4.23-1 |
haproxyDebian:13 |
before 1.4.23-1 | 1.4.23-1 |
haproxyDebian:14 |
before 1.4.23-1 | 1.4.23-1 |
haproxyDebian:6.0 |
before 1.4.8-1+squeeze1, plus listed versions 1.4.8-1 |
1.4.8-1+squeeze1 |
haproxyRed Hat:openshift:1::el6 |
before 0:1.4.22-5.el6op | 0:1.4.22-5.el6op |
haproxy-debuginfoRed Hat:openshift:1::el6 |
before 0:1.4.22-5.el6op | 0:1.4.22-5.el6op |
haproxyRed Hat:enterprise_linux:6::server |
before 0:1.4.22-4.el6_4 | 0:1.4.22-4.el6_4 |
haproxy-debuginfoRed Hat:enterprise_linux:6::server |
before 0:1.4.22-4.el6_4 | 0:1.4.22-4.el6_4 |
haproxyopenSUSE:Tumbleweed |
before 1.7.0-1.1 | 1.7.0-1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
lists.fedoraproject.org/pipermail/package-announce/2013-April/103794.html
rhn.redhat.com/errata/RHSA-2013-0868.html
secunia.com/advisories/52725
debian.org/security/2013/dsa-2711
Show 21 moreShow less
securityfocus.com/bid/58820
ubuntu.com/usn/USN-1800-1
openwall.com/lists/oss-security/2013/04/03/1
nvd.nist.gov/vuln/detail/CVE-2013-1912
github.com/advisories/GHSA-xgv2-5whc-jjqv
security-tracker.debian.org/tracker/CVE-2013-1912
access.redhat.com/errata/RHSA-2013:0729
bugzilla.redhat.com/show_bug.cgi?id=947581
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0729.json
cve.org/CVERecord?id=CVE-2013-1912
suse.com/security/cve/CVE-2012-2391