Every CVE Search/ Get API key

CVE-2023-45539

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers...

8.2 HighPublic exploitFix available

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
None

Exploit likelihood

1.51%Up 1.5 points since Nov 29, 2023
90%50%10%1%

What each source reports

NVD Score used 8.2

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.

Record
CVE-2023-45539
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness
CWE-116
Updated
2026-11-02
CVE List 8.2

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.

Record
CVE-2023-45539
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness
CWE-116
Updated
2026-11-02
EUVDEUVD-2023-49831 8.2

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.

Record
EUVD-2023-49831
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-79q7-m98p-qvhp 8.2

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers...

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.

Record
GHSA-79q7-m98p-qvhp
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness
CWE-116
Updated
2026-11-02
OSVAZL-32061 8.2

CVE-2023-45539 affecting package haproxy for versions less than 2.4.24-1

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.

Record
AZL-32061
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSV 8.2

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.

Record
CVE-2023-45539
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
Show 34 moreShow less
OSVDEBIAN-CVE-2023-45539 8.2

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.

Record
DEBIAN-CVE-2023-45539
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVOESA-2023-1886 8.2

haproxy security update

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.(CVE-2023-0836)

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.(CVE-2023-45539)

Record
OESA-2023-1886
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVOESA-2023-1918 8.2

haproxy security update

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.(CVE-2023-0836)

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.(CVE-2023-45539)

Record
OESA-2023-1918
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVOESA-2023-1919 8.2

haproxy security update

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.(CVE-2023-0836)

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.(CVE-2023-45539)

Record
OESA-2023-1919
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVRHSA-2024:10267 5.3

Red Hat Security Advisory: haproxy security update

Record
RHSA-2024:10267
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVRHSA-2024:10271 5.3

Red Hat Security Advisory: haproxy security update

Record
RHSA-2024:10271
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVRHSA-2024:1089 7.5

Red Hat Security Advisory: haproxy security update

Record
RHSA-2024:1089
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2024:1142 7.5

Red Hat Security Advisory: haproxy security update

Record
RHSA-2024:1142
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2024:4853 6.0

Red Hat Security Advisory: OpenShift Container Platform 4.15.24 packages and security update

Record
RHSA-2024:4853
CVSS 3.1
6.0 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2024:6412 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.14.36 security update

Record
RHSA-2024:6412
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:8849 5.3

Red Hat Security Advisory: haproxy security update

Record
RHSA-2024:8849
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVRHSA-2024:8874 5.3

Red Hat Security Advisory: haproxy security update

Record
RHSA-2024:8874
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVRHSA-2024:9945 5.3

Red Hat Security Advisory: haproxy security update

Record
RHSA-2024:9945
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2023-45539 8.2

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.

Record
UBUNTU-CVE-2023-45539
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVALSA-2024:1142 No score

Moderate: haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

  • haproxy: Proxy forwards malformed empty Content-Length headers (CVE-2023-40225)
  • haproxy: untrimmed URI fragments may lead to exposure of confidential data on static servers (CVE-2023-45539)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2024:1142
Updated
2026-11-02
OSVALSA-2024:8849 No score

Moderate: haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

  • haproxy: untrimmed URI fragments may lead to exposure of confidential data on static servers (CVE-2023-45539)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2024:8849
Updated
2026-11-02
OSVBIT-haproxy-2023-45539 No score

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.

Record
BIT-haproxy-2023-45539
Updated
2026-11-02
OSVCLSA-2023-1703008559 No score

Fix CVE(s): CVE-2023-45539

  • SECURITY UPDATE: Accepting '#' as part of the URI component might allow remote attackers to obtain sensitive information or have unspecified other impact
    • debian/patches/CVE-2023-45539.patch: h1: do not accept '#' as part of the URI component; h2: reject more chars from the :path pseudo header
    • CVE-2023-45539
Record
CLSA-2023-1703008559
Updated
2026-11-02
OSVCLSA-2023-1703181305 No score

haproxy: Fix of CVE-2023-45539

  • CVE-2023-45539: h1: do not accept '#' as part of the URI component; h2: reject more chars from the :path pseudo header
Record
CLSA-2023-1703181305
Updated
2026-11-02
OSVCLSA-2023-1703181677 No score

haproxy: Fix of CVE-2023-45539

  • CVE-2023-45539: h1: do not accept '#' as part of the URI component; h2: reject more chars from the :path pseudo header
Record
CLSA-2023-1703181677
Updated
2026-11-02
OSVCLSA-2023-1703183093 No score

haproxy: Fix of CVE-2023-45539

  • CVE-2023-45539: do not accept '#' as part of the URI component
Record
CLSA-2023-1703183093
Updated
2026-11-02
OSVCLSA-2023-1703183930 No score

haproxy: Fix of CVE-2023-45539

  • CVE-2023-45539: do not accept '#' as part of the URI component
Record
CLSA-2023-1703183930
Updated
2026-11-02
OSVCLSA-2023-1703611617 No score

Fix CVE(s): CVE-2023-45539

  • SECURITY UPDATE: Accepting '#' as part of the URI component might allow remote attackers to obtain sensitive information or have unspecified other impact
    • debian/patches/CVE-2023-45539.patch: h1: do not accept '#' as part of the URI component; h2: reject more chars from the :path pseudo header
    • CVE-2023-45539
Record
CLSA-2023-1703611617
Updated
2026-11-02
OSVCLSA-2024-1730920903 No score

haproxy: Fix of CVE-2023-45539

  • Fix CVE-2023-45539: fix potential information disclosure by not accepting '#' as a part of the URI component
Record
CLSA-2024-1730920903
Updated
2026-11-02
OSVCLSA-2026-1776342757 No score

haproxy: Fix of CVE-2023-45539

  • CVE-2023-45539: reject '#' as part of the URI to prevent ACL bypass via path_end rules
Record
CLSA-2026-1776342757
Updated
2026-11-02
OSVCLSA-2026-1776343034 No score

haproxy: Fix of CVE-2023-45539

  • CVE-2023-45539: reject '#' as part of the URI to prevent ACL bypass via path_end rules
Record
CLSA-2026-1776343034
Updated
2026-11-02
OSVCLSA-2026-1790671238 No score

haproxy: Fix of CVE-2023-45539

  • CVE-2023-45539: reject '#' as part of the URI to prevent ACL bypass via path_end rules
Record
CLSA-2026-1790671238
Updated
2026-11-02
OSVRLSA-2024:8849 No score

Moderate: haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

  • haproxy: untrimmed URI fragments may lead to exposure of confidential data on static servers (CVE-2023-45539)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2024:8849
Updated
2026-11-02
OSVSUSE-SU-2023:4645-1 No score

Security update for haproxy

This update for haproxy fixes the following issues:

  • CVE-2023-45539: Fixed misinterpretation of a path_end rule with # as part of the URI component (bsc#1217653).
Record
SUSE-SU-2023:4645-1
Updated
2026-11-02
OSVSUSE-SU-2023:4646-1 No score

Security update for haproxy

This update for haproxy fixes the following issues:

  • CVE-2023-45539: Fixed misinterpretation of a path_end rule with # as part of the URI component (bsc#1217653).
  • CVE-2023-40225: reject any empty content-length header value (bsc#1214102).
Record
SUSE-SU-2023:4646-1
Updated
2026-11-02
OSVSUSE-SU-2023:4647-1 No score

Security update for haproxy

This update for haproxy fixes the following issues:

  • CVE-2023-45539: Fixed misinterpretation of a path_end rule with # as part of the URI component (bsc#1217653).
Record
SUSE-SU-2023:4647-1
Updated
2026-11-02
OSVSUSE-SU-2024:2377-1 No score

Security update for haproxy

This update for haproxy fixes the following issues:

  • CVE-2023-45539: Fixed misinterpretation of a path_end rule with # as part of the URI component (bsc#1217653).
Record
SUSE-SU-2024:2377-1
Updated
2026-11-02
OSVUSN-6530-1 No score

haproxy vulnerability

It was discovered that HAProxy incorrectly handled URI components containing the hash character (#). A remote attacker could possibly use this issue to obtain sensitive information, or to bypass certain path_end rules.

Record
USN-6530-1
Updated
2026-11-02
OSVUSN-6530-2 No score

haproxy vulnerability

Seth Manesse and Paul Plasil discovered that HAProxy incorrectly handled URI components containing the hash character (#). A remote attacker could possibly use this issue to obtain sensitive information, or to bypass certain path_end rules.

Record
USN-6530-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
haproxy
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2.4.22-3.el9_3
2.4.22-3.el9_3
haproxy
AlmaLinux:8
 before 1.8.27-5.el8_10.1
1.8.27-5.el8_10.1
haproxy
Azure Linux:2
 before 2.4.24-1
2.4.24-1
haproxy
Bitnami
 before 2.8.2
2.8.2
haproxy
TuxCare:Ubuntu:16.04
 before 1.6.3-1ubuntu0.3+tuxcare.els1
1.6.3-1ubuntu0.3+tuxcare.els1
haproxy-doc
TuxCare:Ubuntu:16.04
 before 1.6.3-1ubuntu0.3+tuxcare.els1
1.6.3-1ubuntu0.3+tuxcare.els1
vim-haproxy
TuxCare:Ubuntu:16.04
 before 1.6.3-1ubuntu0.3+tuxcare.els1
1.6.3-1ubuntu0.3+tuxcare.els1
haproxy
TuxCare:CentOS:8.4
 before 1.8.27-2.el8.tuxcare.els1
1.8.27-2.el8.tuxcare.els1
haproxy
TuxCare:CentOS:8.5
 before 1.8.27-2.el8.tuxcare.els1
1.8.27-2.el8.tuxcare.els1
haproxy
TuxCare:CentOS:6
 before 1.5.18-1.el6.tuxcare.els1
1.5.18-1.el6.tuxcare.els1
Show 105 moreShow less
Affected packages
PackageAffectedFixed
haproxy
TuxCare:OracleLinux:6
 before 1.5.18-1.el6.tuxcare.els1
1.5.18-1.el6.tuxcare.els1
haproxy
TuxCare:Ubuntu:18.04
 before 1.8.8-1ubuntu0.13.tuxcare.els2
1.8.8-1ubuntu0.13.tuxcare.els2
haproxy-doc
TuxCare:Ubuntu:18.04
 before 1.8.8-1ubuntu0.13.tuxcare.els2
1.8.8-1ubuntu0.13.tuxcare.els2
vim-haproxy
TuxCare:Ubuntu:18.04
 before 1.8.8-1ubuntu0.13.tuxcare.els2
1.8.8-1ubuntu0.13.tuxcare.els2
haproxy
TuxCare:CentOS-Stream:8
 before 1.8.27-5.el8.tuxcare.els1
1.8.27-5.el8.tuxcare.els1
haproxy
TuxCare:OracleLinux:7
 before 1.5.18-9.el7_9.1.tuxcare.els1
1.5.18-9.el7_9.1.tuxcare.els1
haproxy
TuxCare:RHEL:7
 before 1.5.18-9.el7_9.1.tuxcare.els1
1.5.18-9.el7_9.1.tuxcare.els1
haproxy
TuxCare:CentOS:7
 before 1.5.18-9.el7_9.1.tuxcare.els1
1.5.18-9.el7_9.1.tuxcare.els1
haproxy
Debian:12
 before 2.6.12-1+deb12u1, plus listed versions
2.6.12-1
2.6.12-1+deb12u1
haproxy
Debian:13
 before 2.6.15-1
2.6.15-1
haproxy
Debian:14
 before 2.6.15-1
2.6.15-1
haproxy
Debian:10
 before 1.8.19-1+deb10u5, plus listed versions
1.8.19-11.8.19-1+deb10u11.8.19-1+deb10u21.8.19-1+deb10u2~bpo9+11.8.19-1+deb10u31.8.19-1+deb10u4
1.8.19-1+deb10u5
haproxy
Debian:11
From an advisory covering 2 CVEs
 before 2.2.9-2+deb11u6, plus listed versions
2.2.9-22.2.9-2+deb11u12.2.9-2+deb11u1~bpo10+12.2.9-2+deb11u22.2.9-2+deb11u2~bpo10+1
Show 4 moreShow less
2.2.9-2+deb11u32.2.9-2+deb11u3~bpo10+12.2.9-2+deb11u42.2.9-2+deb11u5
2.2.9-2+deb11u6
haproxy
Debian:12
From an advisory covering 2 CVEs
 before 2.6.12-1+deb12u1, plus listed versions
2.6.12-1
2.6.12-1+deb12u1
haproxy
openEuler:20.03-LTS-SP1
From an advisory covering 2 CVEs
 before 2.2.16-7.oe1
2.2.16-7.oe1
haproxy
openEuler:20.03-LTS-SP3
From an advisory covering 2 CVEs
 before 2.2.16-7.oe1
2.2.16-7.oe1
haproxy
openEuler:22.03-LTS
From an advisory covering 2 CVEs
 before 2.4.8-6.oe2203
2.4.8-6.oe2203
haproxy
openEuler:22.03-LTS-SP1
From an advisory covering 2 CVEs
 before 2.6.6-8.oe2203sp1
2.6.6-8.oe2203sp1
haproxy
openEuler:22.03-LTS-SP2
From an advisory covering 2 CVEs
 before 2.6.6-8.oe2203sp2
2.6.6-8.oe2203sp2
haproxy
Red Hat:rhel_eus:8.8::appstream
 before 0:1.8.27-5.el8_8.1
0:1.8.27-5.el8_8.1
haproxy-debuginfo
Red Hat:rhel_eus:8.8::appstream
 before 0:1.8.27-5.el8_8.1
0:1.8.27-5.el8_8.1
haproxy-debugsource
Red Hat:rhel_eus:8.8::appstream
 before 0:1.8.27-5.el8_8.1
0:1.8.27-5.el8_8.1
haproxy
Red Hat:rhel_aus:8.4::appstream
 before 0:1.8.27-2.el8_4.1
0:1.8.27-2.el8_4.1
haproxy-debuginfo
Red Hat:rhel_aus:8.4::appstream
 before 0:1.8.27-2.el8_4.1
0:1.8.27-2.el8_4.1
haproxy-debugsource
Red Hat:rhel_aus:8.4::appstream
 before 0:1.8.27-2.el8_4.1
0:1.8.27-2.el8_4.1
haproxy
Red Hat:rhel_e4s:8.4::appstream
 before 0:1.8.27-2.el8_4.1
0:1.8.27-2.el8_4.1
haproxy-debuginfo
Red Hat:rhel_e4s:8.4::appstream
 before 0:1.8.27-2.el8_4.1
0:1.8.27-2.el8_4.1
haproxy-debugsource
Red Hat:rhel_e4s:8.4::appstream
 before 0:1.8.27-2.el8_4.1
0:1.8.27-2.el8_4.1
haproxy
Red Hat:rhel_tus:8.4::appstream
 before 0:1.8.27-2.el8_4.1
0:1.8.27-2.el8_4.1
haproxy-debuginfo
Red Hat:rhel_tus:8.4::appstream
 before 0:1.8.27-2.el8_4.1
0:1.8.27-2.el8_4.1
haproxy-debugsource
Red Hat:rhel_tus:8.4::appstream
 before 0:1.8.27-2.el8_4.1
0:1.8.27-2.el8_4.1
haproxy
Red Hat:rhel_eus:9.2::appstream
From an advisory covering 2 CVEs
 before 0:2.4.17-6.el9_2.2
0:2.4.17-6.el9_2.2
haproxy-debuginfo
Red Hat:rhel_eus:9.2::appstream
From an advisory covering 2 CVEs
 before 0:2.4.17-6.el9_2.2
0:2.4.17-6.el9_2.2
haproxy-debugsource
Red Hat:rhel_eus:9.2::appstream
From an advisory covering 2 CVEs
 before 0:2.4.17-6.el9_2.2
0:2.4.17-6.el9_2.2
haproxy
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:2.4.22-3.el9_3
0:2.4.22-3.el9_3
haproxy-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:2.4.22-3.el9_3
0:2.4.22-3.el9_3
haproxy-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:2.4.22-3.el9_3
0:2.4.22-3.el9_3
haproxy
Red Hat:openshift:4.15::el8
From an advisory covering 2 CVEs
 before 0:2.6.13-4.rhaos4.15.el8
0:2.6.13-4.rhaos4.15.el8
haproxy-debugsource
Red Hat:openshift:4.15::el8
From an advisory covering 2 CVEs
 before 0:2.6.13-4.rhaos4.15.el8
0:2.6.13-4.rhaos4.15.el8
haproxy26
Red Hat:openshift:4.15::el8
From an advisory covering 2 CVEs
 before 0:2.6.13-4.rhaos4.15.el8
0:2.6.13-4.rhaos4.15.el8
haproxy26-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 2 CVEs
 before 0:2.6.13-4.rhaos4.15.el8
0:2.6.13-4.rhaos4.15.el8
podman
Red Hat:openshift:4.15::el8
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el8
3:4.4.1-26.2.rhaos4.15.el8
podman-catatonit
Red Hat:openshift:4.15::el8
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el8
3:4.4.1-26.2.rhaos4.15.el8
podman-catatonit-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el8
3:4.4.1-26.2.rhaos4.15.el8
podman-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el8
3:4.4.1-26.2.rhaos4.15.el8
podman-debugsource
Red Hat:openshift:4.15::el8
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el8
3:4.4.1-26.2.rhaos4.15.el8
podman-docker
Red Hat:openshift:4.15::el8
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el8
3:4.4.1-26.2.rhaos4.15.el8
podman-gvproxy
Red Hat:openshift:4.15::el8
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el8
3:4.4.1-26.2.rhaos4.15.el8
podman-gvproxy-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el8
3:4.4.1-26.2.rhaos4.15.el8
podman-plugins
Red Hat:openshift:4.15::el8
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el8
3:4.4.1-26.2.rhaos4.15.el8
podman-plugins-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el8
3:4.4.1-26.2.rhaos4.15.el8
podman-remote
Red Hat:openshift:4.15::el8
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el8
3:4.4.1-26.2.rhaos4.15.el8
podman-remote-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el8
3:4.4.1-26.2.rhaos4.15.el8
podman-tests
Red Hat:openshift:4.15::el8
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el8
3:4.4.1-26.2.rhaos4.15.el8
podman
Red Hat:openshift:4.15::el9
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el9
3:4.4.1-26.2.rhaos4.15.el9
podman-debuginfo
Red Hat:openshift:4.15::el9
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el9
3:4.4.1-26.2.rhaos4.15.el9
podman-debugsource
Red Hat:openshift:4.15::el9
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el9
3:4.4.1-26.2.rhaos4.15.el9
podman-docker
Red Hat:openshift:4.15::el9
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el9
3:4.4.1-26.2.rhaos4.15.el9
podman-gvproxy
Red Hat:openshift:4.15::el9
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el9
3:4.4.1-26.2.rhaos4.15.el9
podman-gvproxy-debuginfo
Red Hat:openshift:4.15::el9
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el9
3:4.4.1-26.2.rhaos4.15.el9
podman-plugins
Red Hat:openshift:4.15::el9
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el9
3:4.4.1-26.2.rhaos4.15.el9
podman-plugins-debuginfo
Red Hat:openshift:4.15::el9
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el9
3:4.4.1-26.2.rhaos4.15.el9
podman-remote
Red Hat:openshift:4.15::el9
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el9
3:4.4.1-26.2.rhaos4.15.el9
podman-remote-debuginfo
Red Hat:openshift:4.15::el9
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el9
3:4.4.1-26.2.rhaos4.15.el9
podman-tests
Red Hat:openshift:4.15::el9
From an advisory covering 2 CVEs
 before 3:4.4.1-26.2.rhaos4.15.el9
3:4.4.1-26.2.rhaos4.15.el9
openshift
Red Hat:openshift:4.14::el8
From an advisory covering 2 CVEs
 before 0:4.14.0-202409041843.p0.g03a907c.assembly.stream.el8
0:4.14.0-202409041843.p0.g03a907c.assembly.stream.el8
openshift-hyperkube
Red Hat:openshift:4.14::el8
From an advisory covering 2 CVEs
 before 0:4.14.0-202409041843.p0.g03a907c.assembly.stream.el8
0:4.14.0-202409041843.p0.g03a907c.assembly.stream.el8
openshift
Red Hat:openshift:4.14::el9
From an advisory covering 2 CVEs
 before 0:4.14.0-202409041843.p0.g03a907c.assembly.stream.el9
0:4.14.0-202409041843.p0.g03a907c.assembly.stream.el9
openshift-hyperkube
Red Hat:openshift:4.14::el9
From an advisory covering 2 CVEs
 before 0:4.14.0-202409041843.p0.g03a907c.assembly.stream.el9
0:4.14.0-202409041843.p0.g03a907c.assembly.stream.el9
haproxy
Red Hat:openshift:4.14::el8
From an advisory covering 2 CVEs
 before 0:2.6.13-4.rhaos4.14.el8
0:2.6.13-4.rhaos4.14.el8
haproxy-debugsource
Red Hat:openshift:4.14::el8
From an advisory covering 2 CVEs
 before 0:2.6.13-4.rhaos4.14.el8
0:2.6.13-4.rhaos4.14.el8
haproxy26
Red Hat:openshift:4.14::el8
From an advisory covering 2 CVEs
 before 0:2.6.13-4.rhaos4.14.el8
0:2.6.13-4.rhaos4.14.el8
haproxy26-debuginfo
Red Hat:openshift:4.14::el8
From an advisory covering 2 CVEs
 before 0:2.6.13-4.rhaos4.14.el8
0:2.6.13-4.rhaos4.14.el8
haproxy
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.27-5.el8_10.1
0:1.8.27-5.el8_10.1
haproxy-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.27-5.el8_10.1
0:1.8.27-5.el8_10.1
haproxy-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.27-5.el8_10.1
0:1.8.27-5.el8_10.1
haproxy
Red Hat:rhel_aus:8.6::appstream
 before 0:1.8.27-4.el8_6.1
0:1.8.27-4.el8_6.1
haproxy-debuginfo
Red Hat:rhel_aus:8.6::appstream
 before 0:1.8.27-4.el8_6.1
0:1.8.27-4.el8_6.1
haproxy-debugsource
Red Hat:rhel_aus:8.6::appstream
 before 0:1.8.27-4.el8_6.1
0:1.8.27-4.el8_6.1
haproxy
Red Hat:rhel_e4s:8.6::appstream
 before 0:1.8.27-4.el8_6.1
0:1.8.27-4.el8_6.1
haproxy-debuginfo
Red Hat:rhel_e4s:8.6::appstream
 before 0:1.8.27-4.el8_6.1
0:1.8.27-4.el8_6.1
haproxy-debugsource
Red Hat:rhel_e4s:8.6::appstream
 before 0:1.8.27-4.el8_6.1
0:1.8.27-4.el8_6.1
haproxy
Red Hat:rhel_tus:8.6::appstream
 before 0:1.8.27-4.el8_6.1
0:1.8.27-4.el8_6.1
haproxy-debuginfo
Red Hat:rhel_tus:8.6::appstream
 before 0:1.8.27-4.el8_6.1
0:1.8.27-4.el8_6.1
haproxy-debugsource
Red Hat:rhel_tus:8.6::appstream
 before 0:1.8.27-4.el8_6.1
0:1.8.27-4.el8_6.1
haproxy
Red Hat:rhel_aus:8.2::appstream
 before 0:1.8.23-3.el8_2.1
0:1.8.23-3.el8_2.1
haproxy-debuginfo
Red Hat:rhel_aus:8.2::appstream
 before 0:1.8.23-3.el8_2.1
0:1.8.23-3.el8_2.1
haproxy-debugsource
Red Hat:rhel_aus:8.2::appstream
 before 0:1.8.23-3.el8_2.1
0:1.8.23-3.el8_2.1
haproxy
Rocky Linux:8
 before 0:1.8.27-5.el8_10.1
0:1.8.27-5.el8_10.1
haproxy
SUSE:Linux Enterprise High Availability Extension 15 SP2
 before 2.0.31-150200.11.26.1
2.0.31-150200.11.26.1
haproxy
SUSE:Linux Enterprise High Availability Extension 15 SP3
 before 2.0.31-150200.11.26.1
2.0.31-150200.11.26.1
haproxy
SUSE:Linux Enterprise High Availability Extension 15 SP1
From an advisory covering 2 CVEs
 before 2.0.31-150100.8.34.1
2.0.31-150100.8.34.1
haproxy
SUSE:Linux Enterprise Micro 5.3
 before 2.4.22+git0.f8e3218e2-150400.3.19.1
2.4.22+git0.f8e3218e2-150400.3.19.1
haproxy
SUSE:Linux Enterprise Micro 5.4
 before 2.4.22+git0.f8e3218e2-150400.3.19.1
2.4.22+git0.f8e3218e2-150400.3.19.1
haproxy
SUSE:Linux Enterprise Micro 5.5
 before 2.4.22+git0.f8e3218e2-150400.3.19.1
2.4.22+git0.f8e3218e2-150400.3.19.1
haproxy
SUSE:Linux Enterprise High Availability Extension 15 SP4
 before 2.4.22+git0.f8e3218e2-150400.3.19.1
2.4.22+git0.f8e3218e2-150400.3.19.1
haproxy
SUSE:Linux Enterprise High Availability Extension 15 SP5
 before 2.4.22+git0.f8e3218e2-150400.3.19.1
2.4.22+git0.f8e3218e2-150400.3.19.1
haproxy
openSUSE:Leap Micro 5.3
 before 2.4.22+git0.f8e3218e2-150400.3.19.1
2.4.22+git0.f8e3218e2-150400.3.19.1
haproxy
openSUSE:Leap Micro 5.4
 before 2.4.22+git0.f8e3218e2-150400.3.19.1
2.4.22+git0.f8e3218e2-150400.3.19.1
haproxy
openSUSE:Leap 15.4
 before 2.4.22+git0.f8e3218e2-150400.3.19.1
2.4.22+git0.f8e3218e2-150400.3.19.1
haproxy
openSUSE:Leap 15.5
 before 2.4.22+git0.f8e3218e2-150400.3.19.1
2.4.22+git0.f8e3218e2-150400.3.19.1
haproxy
Ubuntu:Pro:16.04:LTS
 before 1.6.3-1ubuntu0.3+esm1, plus listed versions
1.5.14-11.5.15-11.6.2-11.6.2-21.6.2-2ubuntu1
Show 5 moreShow less
1.6.2-2ubuntu31.6.3-11.6.3-1ubuntu0.11.6.3-1ubuntu0.21.6.3-1ubuntu0.3
1.6.3-1ubuntu0.3+esm1
haproxy
Ubuntu:Pro:18.04:LTS
 before 1.8.8-1ubuntu0.13+esm2, plus listed versions
1.7.9-1ubuntu11.7.9-1ubuntu21.8.4-11.8.7-11.8.8-1
Show 11 moreShow less
1.8.8-1ubuntu0.11.8.8-1ubuntu0.21.8.8-1ubuntu0.31.8.8-1ubuntu0.41.8.8-1ubuntu0.61.8.8-1ubuntu0.71.8.8-1ubuntu0.81.8.8-1ubuntu0.91.8.8-1ubuntu0.101.8.8-1ubuntu0.111.8.8-1ubuntu0.13
1.8.8-1ubuntu0.13+esm2
haproxy
Ubuntu:20.04:LTS
 before 2.0.31-0ubuntu0.3, plus listed versions
2.0.5-12.0.8-12.0.9-12.0.10-12.0.10-1ubuntu1
Show 13 moreShow less
2.0.11-1ubuntu12.0.12-1ubuntu22.0.13-1ubuntu22.0.13-22.0.13-2ubuntu0.12.0.13-2ubuntu0.22.0.13-2ubuntu0.32.0.13-2ubuntu0.52.0.29-0ubuntu12.0.29-0ubuntu1.12.0.29-0ubuntu1.32.0.31-0ubuntu0.12.0.31-0ubuntu0.2
2.0.31-0ubuntu0.3
haproxy
Ubuntu:22.04:LTS
 before 2.4.22-0ubuntu0.22.04.3, plus listed versions
2.2.9-2ubuntu22.4.8-12.4.8-2ubuntu32.4.11-1ubuntu12.4.12-1ubuntu1
Show 9 moreShow less
2.4.12-1ubuntu22.4.13-1ubuntu12.4.14-1ubuntu12.4.18-0ubuntu12.4.18-0ubuntu1.12.4.18-0ubuntu1.22.4.18-0ubuntu1.32.4.22-0ubuntu0.22.04.12.4.22-0ubuntu0.22.04.2
2.4.22-0ubuntu0.22.04.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubslicingmelon/HAProxy-CVE-2023-45539-PoC2025-08-27

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-45539 is a high vulnerability (CVSS 8.2) in Haproxy, published November 28, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.51%, the 74th percentile. Fixed in haproxy 1.8.27-5.el8_10.1.

References

Show 67 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open