Every CVE Search/ Get API key

CVE-2022-0711

A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header....

7.5 HighFix available

A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

16.6%Up 15.7 points since Mar 3, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.

Record
CVE-2022-0711
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-835
Updated
2026-11-02
CVE List No score

A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.

Record
CVE-2022-0711
Weakness
CWE-835
Updated
2026-11-02
EUVDEUVD-2022-15786 No score

A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.

Record
EUVD-2022-15786
Updated
2026-11-03
GitHub AdvisoriesGHSA-x4fc-x944-v9p7 7.5

A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header....

A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.

Record
GHSA-x4fc-x944-v9p7
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-02
OSVALPINE-CVE-2022-0711 7.5

A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.

Record
ALPINE-CVE-2022-0711
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVAZL-8899 7.5

CVE-2022-0711 affecting package haproxy for versions less than 2.4.13-1

A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.

Record
AZL-8899
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 14 moreShow less
OSVDEBIAN-CVE-2022-0711 7.5

A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.

Record
DEBIAN-CVE-2022-0711
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVOESA-2022-1578 7.5

haproxy security update

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.(CVE-2022-0711)

Record
OESA-2022-1578
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2022-2054 7.5

haproxy security update

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.(CVE-2022-0711)

Record
OESA-2022-2054
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2022:1021 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.9.26 security update

Record
RHSA-2022:1021
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:1153 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.8.36 security update

Record
RHSA-2022:1153
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2022:1336 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.7.49 security update

Record
RHSA-2022:1336
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2022:1620 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.6.57 packages and security update

Record
RHSA-2022:1620
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2022-0711 7.5

A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.

Record
UBUNTU-CVE-2022-0711
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBIT-haproxy-2022-0711 No score

A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.

Record
BIT-haproxy-2022-0711
Updated
2026-11-02
OSV No score

A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.

Record
CVE-2022-0711
Weakness
CWE-835
Updated
2026-11-02
OSVopenSUSE-SU-2024:11876-1 No score

haproxy-2.5.4+git0.e55ab4208-1.1 on GA media

These are all security issues fixed in the haproxy-2.5.4+git0.e55ab4208-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11876-1
Updated
2026-11-02
OSVROOT-OS-ALPINE-316-CVE-2022-0711 No score

CVE-2022-0711 in rootio-haproxy - Patched by Root

Root has patched CVE-2022-0711 in the rootio-haproxy package for Root:Alpine:3.16. Multiple fixed versions available.

Record
ROOT-OS-ALPINE-316-CVE-2022-0711
Updated
2026-11-02
OSVSUSE-SU-2022:2277-1 No score

Security update for haproxy

This update for haproxy fixes the following issues:

  • CVE-2022-0711: haproxy: Denial of service via set-cookie2 header (bsc#1196408).
Record
SUSE-SU-2022:2277-1
Updated
2026-11-02
OSVUSN-5312-1 No score

haproxy vulnerability

It was discovered that HAProxy incorrectly handled certain headers. A remote attacker could possibly use this issue to cause HAProxy to stop responding, resulting in a denial of service.

Record
USN-5312-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
haproxy
Alpine:v3.12
 2.2.0 up to 2.2.21-r0
2.2.21-r0
haproxy
Alpine:v3.13
 2.2.0 up to 2.2.21-r0
2.2.21-r0
haproxy
Azure Linux:2
 before 2.4.13-1
2.4.13-1
haproxy
Bitnami
 2.2.0 up to 2.2.21, 2.3.0 up to 2.3.18, 2.4.0 up to 2.4.13
2.2.212.3.182.4.13
haproxy
Debian:12
 before 2.4.13-1
2.4.13-1
haproxy
Debian:13
 before 2.4.13-1
2.4.13-1
haproxy
Debian:14
 before 2.4.13-1
2.4.13-1
haproxy
Debian:11
 before 2.2.9-2+deb11u3, plus listed versions
2.2.9-22.2.9-2+deb11u12.2.9-2+deb11u1~bpo10+12.2.9-2+deb11u22.2.9-2+deb11u2~bpo10+12.2.9-2+deb11u3~bpo10+1
2.2.9-2+deb11u3
haproxy
openEuler:20.03-LTS-SP1
 before 2.2.16-3.oe1
2.2.16-3.oe1
haproxy
openEuler:20.03-LTS-SP2
 before 2.2.16-3.oe1
2.2.16-3.oe1
Show 30 moreShow less
Affected packages
PackageAffectedFixed
haproxy
openEuler:20.03-LTS-SP3
 before 2.2.16-3.oe1
2.2.16-3.oe1
haproxy
openEuler:22.03-LTS
 before 2.4.8-2.oe2203
2.4.8-2.oe2203
haproxy
Red Hat:openshift:4.9::el8
From an advisory covering 13 CVEs
 before 0:2.2.15-4.el8
0:2.2.15-4.el8
haproxy-debugsource
Red Hat:openshift:4.9::el8
From an advisory covering 13 CVEs
 before 0:2.2.15-4.el8
0:2.2.15-4.el8
haproxy22
Red Hat:openshift:4.9::el8
From an advisory covering 13 CVEs
 before 0:2.2.15-4.el8
0:2.2.15-4.el8
haproxy22-debuginfo
Red Hat:openshift:4.9::el8
From an advisory covering 13 CVEs
 before 0:2.2.15-4.el8
0:2.2.15-4.el8
jenkins-2-plugins
Red Hat:openshift:4.9::el8
From an advisory covering 13 CVEs
 before 0:4.9.1647580879-1.el8
0:4.9.1647580879-1.el8
haproxy
Red Hat:openshift:4.8::el8
 before 0:2.2.13-3.el8
0:2.2.13-3.el8
haproxy-debugsource
Red Hat:openshift:4.8::el8
 before 0:2.2.13-3.el8
0:2.2.13-3.el8
haproxy22
Red Hat:openshift:4.8::el8
 before 0:2.2.13-3.el8
0:2.2.13-3.el8
haproxy22-debuginfo
Red Hat:openshift:4.8::el8
 before 0:2.2.13-3.el8
0:2.2.13-3.el8
haproxy
Red Hat:openshift:4.7::el7
 before 0:2.0.19-3.el7
0:2.0.19-3.el7
haproxy-debuginfo
Red Hat:openshift:4.7::el7
 before 0:2.0.19-3.el7
0:2.0.19-3.el7
haproxy20
Red Hat:openshift:4.7::el7
 before 0:2.0.19-3.el7
0:2.0.19-3.el7
haproxy
Red Hat:openshift:4.7::el8
 before 0:2.0.19-3.el8
0:2.0.19-3.el8
haproxy-debugsource
Red Hat:openshift:4.7::el8
 before 0:2.0.19-3.el8
0:2.0.19-3.el8
haproxy20
Red Hat:openshift:4.7::el8
 before 0:2.0.19-3.el8
0:2.0.19-3.el8
haproxy20-debuginfo
Red Hat:openshift:4.7::el8
 before 0:2.0.19-3.el8
0:2.0.19-3.el8
haproxy
Red Hat:openshift:4.6::el7
From an advisory covering 13 CVEs
 before 0:2.0.16-3.el7
0:2.0.16-3.el7
haproxy-debuginfo
Red Hat:openshift:4.6::el7
From an advisory covering 13 CVEs
 before 0:2.0.16-3.el7
0:2.0.16-3.el7
haproxy20
Red Hat:openshift:4.6::el7
From an advisory covering 13 CVEs
 before 0:2.0.16-3.el7
0:2.0.16-3.el7
haproxy
Red Hat:openshift:4.6::el8
From an advisory covering 13 CVEs
 before 0:2.0.16-5.el8
0:2.0.16-5.el8
haproxy-debugsource
Red Hat:openshift:4.6::el8
From an advisory covering 13 CVEs
 before 0:2.0.16-5.el8
0:2.0.16-5.el8
haproxy20
Red Hat:openshift:4.6::el8
From an advisory covering 13 CVEs
 before 0:2.0.16-5.el8
0:2.0.16-5.el8
haproxy20-debuginfo
Red Hat:openshift:4.6::el8
From an advisory covering 13 CVEs
 before 0:2.0.16-5.el8
0:2.0.16-5.el8
jenkins-2-plugins
Red Hat:openshift:4.6::el8
From an advisory covering 13 CVEs
 before 0:4.6.1650364520-1.el8
0:4.6.1650364520-1.el8
haproxy
SUSE:Linux Enterprise High Availability Extension 15 SP4
 before 2.4.8+git0.d1f8d41e0-150400.3.3.13
2.4.8+git0.d1f8d41e0-150400.3.3.13
haproxy
openSUSE:Leap 15.4
 before 2.4.8+git0.d1f8d41e0-150400.3.3.13
2.4.8+git0.d1f8d41e0-150400.3.3.13
haproxy
Ubuntu:20.04:LTS
 before 2.0.13-2ubuntu0.5, plus listed versions
2.0.5-12.0.8-12.0.9-12.0.10-12.0.10-1ubuntu1
Show 7 moreShow less
2.0.11-1ubuntu12.0.12-1ubuntu22.0.13-1ubuntu22.0.13-22.0.13-2ubuntu0.12.0.13-2ubuntu0.22.0.13-2ubuntu0.3
2.0.13-2ubuntu0.5
haproxy
openSUSE:Tumbleweed
 before 2.5.4+git0.e55ab4208-1.1
2.5.4+git0.e55ab4208-1.1

History

History
RecordedChangedSources
affected, factsOSV
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-0711 is a high vulnerability (CVSS 7.5) in Haproxy, published March 2, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 16.6%, the 97th percentile. Fixed in haproxy 2.2.21-r0.

References

Show 71 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open