Every CVE Search/ Get API key

CVE-2024-45506

HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote...

7.5 HighFix available

HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.20%Up 1.2 points since Sep 5, 2024
90%50%10%1%

What each source reports

NVD Score used 7.5

HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.

Record
CVE-2024-45506
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-02
CVE List 7.5

HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.

Record
CVE-2024-45506
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-02
EUVDEUVD-2024-41515 7.5

HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.

Record
EUVD-2024-41515
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-gmvf-rv8w-2hrh 7.5

HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote...

HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service.

Record
GHSA-gmvf-rv8w-2hrh
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-02
OSVAZL-48668 7.5

CVE-2024-45506 affecting package haproxy for versions less than 2.9.11-1

HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.

Record
AZL-48668
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 7.5

HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.

Record
CVE-2024-45506
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-06
Show 5 moreShow less
OSVDEBIAN-CVE-2024-45506 7.5

HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.

Record
DEBIAN-CVE-2024-45506
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-2130 7.5

haproxy security update

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service.(CVE-2024-45506)

Record
OESA-2024-2130
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-45506 7.5

HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.

Record
UBUNTU-CVE-2024-45506
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBIT-haproxy-2024-45506 No score

HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.

Record
BIT-haproxy-2024-45506
Updated
2026-11-02
OSVopenSUSE-SU-2024:14307-1 No score

haproxy-3.0.4+git0.7a59afa93-1.1 on GA media

These are all security issues fixed in the haproxy-3.0.4+git0.7a59afa93-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14307-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
haproxy
Azure Linux:3
 before 2.9.11-1
2.9.11-1
haproxy
Bitnami
 2.9.0 up to 2.9.10, 3.0.0 up to 3.0.4
2.9.103.0.4
haproxy
Debian:13
 before 2.9.10-1
2.9.10-1
haproxy
Debian:14
 before 2.9.10-1
2.9.10-1
haproxy
openEuler:24.03-LTS
 before 2.9.5-4.oe2403
2.9.5-4.oe2403
haproxy
openSUSE:Tumbleweed
 before 3.0.4+git0.7a59afa93-1.1
3.0.4+git0.7a59afa93-1.1

History

History
RecordedChangedSources
factsOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-45506 is a high vulnerability (CVSS 7.5) in Haproxy, published September 4, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.20%, the 68th percentile. Fixed in haproxy 2.9.11-1.

References

Show 8 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open