CVE-2023-0836
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4...
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.
- Record
CVE-2023-0836- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200, CWE-459
- Updated
- 2026-11-02
CVE List
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.
- Record
CVE-2023-0836- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200, CWE-459
- Updated
- 2026-11-02
EUVDEUVD-2023-12837
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.
- Record
EUVD-2023-12837- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xhfw-qhxr-hjhq
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4...
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.
- Record
GHSA-xhfw-qhxr-hjhq- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200, CWE-459
- Updated
- 2026-11-02
OSV
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.
- Record
CVE-2023-0836- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-0836
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.
- Record
DEBIAN-CVE-2023-0836- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 9 moreShow less
OSVOESA-2023-1886
haproxy security update
HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.
Security Fix(es):
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.(CVE-2023-0836)
HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.(CVE-2023-45539)
- Record
OESA-2023-1886- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2023-1918
haproxy security update
HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.
Security Fix(es):
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.(CVE-2023-0836)
HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.(CVE-2023-45539)
- Record
OESA-2023-1918- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2023-1919
haproxy security update
HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.
Security Fix(es):
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.(CVE-2023-0836)
HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.(CVE-2023-45539)
- Record
OESA-2023-1919- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2023:6496
Red Hat Security Advisory: haproxy security and bug fix update
- Record
RHSA-2023:6496- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-0836
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.
- Record
UBUNTU-CVE-2023-0836- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVALSA-2023:6496 No score
Moderate: haproxy security and bug fix update
The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.
Security Fix(es):
- haproxy: data leak via fcgi requests (CVE-2023-0836)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2023:6496- Updated
- 2026-11-02
OSVBIT-haproxy-2023-0836 No score
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.
- Record
BIT-haproxy-2023-0836- Updated
- 2026-11-02
OSVCLSA-2025-1736284126 No score
haproxy: Fix of CVE-2023-0836
- CVE-2023-0836: Fix information leak vulnerability in connection buffer by initializing 5 bytes in FCGI_BEGIN_REQUEST record encoding.
- Record
CLSA-2025-1736284126- Updated
- 2026-11-02
OSVUSN-5994-1 No score
haproxy vulnerability
It was discovered that HAProxy incorrectly initialized certain connection buffers. A remote attacker could possibly use this issue to obtain sensitive information.
- Record
USN-5994-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
haproxyAlmaLinux:9 |
before 2.4.22-1.el9 | 2.4.22-1.el9 |
haproxyBitnami |
2.1.0 up to 2.1.1, 2.2.0 up to 2.2.27, 2.3.0 up to 2.3.1, 2.4.0 up to 2.4.22, 2.5.0 up to 2.5.12, 2.6.0 up to 2.6.9, 2.7.0 up to 2.7.1 | 2.1.12.2.272.3.12.4.222.5.122.6.92.7.1 |
haproxyTuxCare:AlmaLinux:9.2 |
before 2.4.17-6.el9.tuxcare.els1 | 2.4.17-6.el9.tuxcare.els1 |
haproxyDebian:12 |
before 2.6.8-1 | 2.6.8-1 |
haproxyDebian:13 |
before 2.6.8-1 | 2.6.8-1 |
haproxyDebian:14 |
before 2.6.8-1 | 2.6.8-1 |
haproxyDebian:11 |
before 2.2.9-2+deb11u5, plus listed versions 2.2.9-22.2.9-2+deb11u12.2.9-2+deb11u1~bpo10+12.2.9-2+deb11u22.2.9-2+deb11u2~bpo10+12.2.9-2+deb11u32.2.9-2+deb11u3~bpo10+12.2.9-2+deb11u4 |
2.2.9-2+deb11u5 |
haproxyopenEuler:20.03-LTS-SP1 From an advisory covering 2 CVEs |
before 2.2.16-7.oe1 | 2.2.16-7.oe1 |
haproxyopenEuler:20.03-LTS-SP3 From an advisory covering 2 CVEs |
before 2.2.16-7.oe1 | 2.2.16-7.oe1 |
haproxyopenEuler:22.03-LTS From an advisory covering 2 CVEs |
before 2.4.8-6.oe2203 | 2.4.8-6.oe2203 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
haproxyopenEuler:22.03-LTS-SP1 From an advisory covering 2 CVEs |
before 2.6.6-8.oe2203sp1 | 2.6.6-8.oe2203sp1 |
haproxyopenEuler:22.03-LTS-SP2 From an advisory covering 2 CVEs |
before 2.6.6-8.oe2203sp2 | 2.6.6-8.oe2203sp2 |
haproxyRed Hat:enterprise_linux:9::appstream |
before 0:2.4.22-1.el9 | 0:2.4.22-1.el9 |
haproxy-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:2.4.22-1.el9 | 0:2.4.22-1.el9 |
haproxy-debugsourceRed Hat:enterprise_linux:9::appstream |
before 0:2.4.22-1.el9 | 0:2.4.22-1.el9 |
haproxyUbuntu:22.04:LTS |
before 2.4.18-0ubuntu1.3, plus listed versions 2.2.9-2ubuntu22.4.8-12.4.8-2ubuntu32.4.11-1ubuntu12.4.12-1ubuntu1 Show 6 moreShow less2.4.12-1ubuntu22.4.13-1ubuntu12.4.14-1ubuntu12.4.18-0ubuntu12.4.18-0ubuntu1.12.4.18-0ubuntu1.2 |
2.4.18-0ubuntu1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-0836 is a high vulnerability (CVSS 7.5) in Haproxy, published March 27, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.20%, the 68th percentile. Fixed in haproxy 2.4.22-1.el9.
References
git.haproxy.org?p=haproxy.git%3Ba=commitdiff%3Bh=2e6bf0a
debian.org/security/2023/dsa-5388
nvd.nist.gov/vuln/detail/CVE-2023-0836
github.com/advisories/GHSA-xhfw-qhxr-hjhq
access.redhat.com/errata/RHSA-2023:6496
Show 19 moreShow less
bugzilla.redhat.com/2180746
errata.almalinux.org/9/ALSA-2023-6496.html
errata.tuxcare.com/almalinux9.2-esu/CLSA-2025-1736284126.html
security-tracker.debian.org/tracker/CVE-2023-0836
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1886
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6496.json
cve.org/CVERecord?id=CVE-2023-0836
ubuntu.com/security/CVE-2023-0836