Every CVE Search/ Get API key

CVE-2019-19330

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by...

9.8 CriticalFix available

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

4.03%Up 2.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.

Record
CVE-2019-19330
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-74
Updated
2026-11-02
CVE List No score

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.

Record
CVE-2019-19330
Updated
2026-11-02
EUVDEUVD-2019-8951 No score

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.

Record
EUVD-2019-8951
Updated
2026-11-03
GitHub AdvisoriesGHSA-x4px-pm9c-vmjm 9.8

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by...

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.

Record
GHSA-x4px-pm9c-vmjm
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-74
Updated
2026-11-02
OSVALPINE-CVE-2019-19330 9.8

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.

Record
ALPINE-CVE-2019-19330
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.8

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.

Record
CVE-2019-19330
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2019-19330 9.8

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.

Record
DEBIAN-CVE-2019-19330
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:1287 8.8

Red Hat Security Advisory: OpenShift Container Platform 3.11 security update

Record
RHSA-2020:1287
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:1725 6.5

Red Hat Security Advisory: haproxy security, bug fix, and enhancement update

Record
RHSA-2020:1725
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2020:1936 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.4.3 haproxy security update

Record
RHSA-2020:1936
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:2265 6.5

Red Hat Security Advisory: rh-haproxy18-haproxy security, bug fix, and enhancement update

Record
RHSA-2020:2265
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2019-19330 9.8

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.

Record
UBUNTU-CVE-2019-19330
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUSN-4212-1 No score

haproxy vulnerability

Tim Düsterhus discovered that HAProxy incorrectly handled certain HTTP/2 headers. An attacker could possibly use this issue to execute arbitrary code through CRLF injection.

Record
USN-4212-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
haproxy
Alpine:v3.8
 before 1.8.23
1.8.23
haproxy
Alpine:v3.9
 before 1.8.23-r0
1.8.23-r0
haproxy
Debian:12
 before 2.0.10-1
2.0.10-1
haproxy
Debian:13
 before 2.0.10-1
2.0.10-1
haproxy
Debian:14
 before 2.0.10-1
2.0.10-1
haproxy
Debian:10
 before 1.8.19-1+deb10u1, plus listed versions
1.8.19-1
1.8.19-1+deb10u1
haproxy
Red Hat:openshift:3.11::el7
From an advisory covering 3 CVEs
 before 0:1.8.23-3.el7
0:1.8.23-3.el7
haproxy-debuginfo
Red Hat:openshift:3.11::el7
From an advisory covering 3 CVEs
 before 0:1.8.23-3.el7
0:1.8.23-3.el7
haproxy18
Red Hat:openshift:3.11::el7
From an advisory covering 3 CVEs
 before 0:1.8.23-3.el7
0:1.8.23-3.el7
haproxy
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.8.23-3.el8
0:1.8.23-3.el8
Show 13 moreShow less
Affected packages
PackageAffectedFixed
haproxy-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.8.23-3.el8
0:1.8.23-3.el8
haproxy-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.8.23-3.el8
0:1.8.23-3.el8
haproxy
Red Hat:openshift:4.4::el7
From an advisory covering 3 CVEs
 before 0:2.0.13-3.el7
0:2.0.13-3.el7
haproxy-debuginfo
Red Hat:openshift:4.4::el7
From an advisory covering 3 CVEs
 before 0:2.0.13-3.el7
0:2.0.13-3.el7
haproxy20
Red Hat:openshift:4.4::el7
From an advisory covering 3 CVEs
 before 0:2.0.13-3.el7
0:2.0.13-3.el7
haproxy
Red Hat:openshift:4.4::el8
From an advisory covering 3 CVEs
 before 0:2.0.13-3.el8
0:2.0.13-3.el8
haproxy-debugsource
Red Hat:openshift:4.4::el8
From an advisory covering 3 CVEs
 before 0:2.0.13-3.el8
0:2.0.13-3.el8
haproxy20
Red Hat:openshift:4.4::el8
From an advisory covering 3 CVEs
 before 0:2.0.13-3.el8
0:2.0.13-3.el8
haproxy20-debuginfo
Red Hat:openshift:4.4::el8
From an advisory covering 3 CVEs
 before 0:2.0.13-3.el8
0:2.0.13-3.el8
rh-haproxy18-haproxy
Red Hat:rhel_software_collections:3::el7
From an advisory covering 2 CVEs
 before 0:1.8.24-2.el7
0:1.8.24-2.el7
rh-haproxy18-haproxy-debuginfo
Red Hat:rhel_software_collections:3::el7
From an advisory covering 2 CVEs
 before 0:1.8.24-2.el7
0:1.8.24-2.el7
rh-haproxy18-haproxy-syspaths
Red Hat:rhel_software_collections:3::el7
From an advisory covering 2 CVEs
 before 0:1.8.24-2.el7
0:1.8.24-2.el7
haproxy
Ubuntu:18.04:LTS
 before 1.8.8-1ubuntu0.9, plus listed versions
1.7.9-1ubuntu11.7.9-1ubuntu21.8.4-11.8.7-11.8.8-1
Show 7 moreShow less
1.8.8-1ubuntu0.11.8.8-1ubuntu0.21.8.8-1ubuntu0.31.8.8-1ubuntu0.41.8.8-1ubuntu0.61.8.8-1ubuntu0.71.8.8-1ubuntu0.8
1.8.8-1ubuntu0.9

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-19330 is a critical vulnerability (CVSS 9.8) in Haproxy, published November 27, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.03%, the 90th percentile. Fixed in haproxy 1.8.23.

References

Show 40 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open