CVE-2013-2175

HAProxy 1.4 before 1.4.24 and 1.5 before 1.5-dev19, when configured to use hdr_ip or other "hdr_*...

5.0 MediumFix available

HAProxy 1.4 before 1.4.24 and 1.5 before 1.5-dev19, when configured to use hdr_ip or other "hdr_*" functions with a negative occurrence count, allows remote attackers to cause a denial of service (negative array index usage and crash) via an HTTP header with a certain number of values, related to the MAX_HDR_HISTORY variable.

Exploit likelihood

3.59%Up 2.3 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Record: CVE-2013-2175
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-20, CWE-284
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-2175
Updated: 2026-11-02

EUVDEUVD-2013-2134 No score

Record: EUVD-2013-2134
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4wh9-9j6m-2gcq No score

HAProxy 1.4 before 1.4.24 and 1.5 before 1.5-dev19, when configured to use hdr_ip or other "hdr_*...

Record: GHSA-4wh9-9j6m-2gcq
Weakness: CWE-20
Updated: 2026-11-02

OSV No score

Record: CVE-2013-2175
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-2175 No score

Record: DEBIAN-CVE-2013-2175
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10114-1 No score

haproxy-1.7.0-1.1 on GA media

These are all security issues fixed in the haproxy-1.7.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10114-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`haproxy` Debian:12	before 1.4.24-1	1.4.24-1
`haproxy` Debian:13	before 1.4.24-1	1.4.24-1
`haproxy` Debian:14	before 1.4.24-1	1.4.24-1
`haproxy` Debian:6.0	before 1.4.8-1+squeeze1, plus listed versions 1.4.8-1	1.4.8-1+squeeze1
`haproxy` Red Hat:enterprise_linux:6::server	before 0:1.4.22-5.el6_4	0:1.4.22-5.el6_4
`haproxy-debuginfo` Red Hat:enterprise_linux:6::server	before 0:1.4.22-5.el6_4	0:1.4.22-5.el6_4
`haproxy` Red Hat:openshift:1.2::el6	before 0:1.4.22-6.el6op	0:1.4.22-6.el6op
`haproxy-debuginfo` Red Hat:openshift:1.2::el6	before 0:1.4.22-6.el6op	0:1.4.22-6.el6op
`haproxy` openSUSE:Tumbleweed	before 1.7.0-1.1	1.7.0-1.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-2175 is a medium vulnerability (CVSS 5.0) in Haproxy, published June 19, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.59%, the 89th percentile. Fixed in haproxy 1.4.24-1.

References

Show 17 moreShow less