Every CVE Search/ Get API key

CVE-2024-49214

QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening...

5.3 MediumFix available

QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.52%Up 0.5 points since Oct 14, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.3

QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.

Record
CVE-2024-49214
CVSS 3.1
5.3 MediumCVSS:3.1/AC:L/AV:N/A:N/C:N/I:L/PR:N/S:U/UI:N
Weakness
CWE-290
Updated
2026-11-02
EUVDEUVD-2024-43285 5.3

QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.

Record
EUVD-2024-43285
CVSS 3.1
5.3 MediumCVSS:3.1/AC:L/AV:N/A:N/C:N/I:L/PR:N/S:U/UI:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-8jgf-8r3g-hxh8 5.3

QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening...

QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.

Record
GHSA-8jgf-8r3g-hxh8
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-290
Updated
2026-11-02
NVD 5.3

QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.

Record
CVE-2024-49214
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-290
Updated
2026-11-02
OSV 5.3

QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.

Record
CVE-2024-49214
CVSS 3.1
5.3 MediumCVSS:3.1/AC:L/AV:N/A:N/C:N/I:L/PR:N/S:U/UI:N
Updated
2026-11-02
OSVDEBIAN-CVE-2024-49214 5.3

QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.

Record
DEBIAN-CVE-2024-49214
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVOESA-2024-2273 5.3

haproxy security update

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.(CVE-2024-49214)

Record
OESA-2024-2273
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVAZL-50333 No score

CVE-2024-49214 affecting package haproxy for versions less than 2.4.24-1

QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.

Record
AZL-50333
Updated
2026-11-02
OSVBIT-haproxy-2024-49214 No score

QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.

Record
BIT-haproxy-2024-49214
Updated
2026-11-02
OSVopenSUSE-SU-2024:14402-1 No score

haproxy-3.0.5+git0.8e879a52e-2.1 on GA media

These are all security issues fixed in the haproxy-3.0.5+git0.8e879a52e-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14402-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
haproxy
Azure Linux:2
 before 2.4.24-1
2.4.24-1
haproxy
Bitnami
 before 2.9.11, 3.0.0 up to 3.0.5
2.9.113.0.5
haproxy
Debian:12
 All versions, plus listed versions
2.6.12-12.6.12-1+deb12u12.6.12-1+deb12u22.6.12-1+deb12u32.6.12-1+deb12u4
Show 45 moreShow less
2.6.13-12.6.14-12.6.15-12.7.0-12.7.1-12.7.2-12.7.2-22.7.3-12.7.4-12.7.5-12.7.6-12.7.7-12.7.8-12.8.0-12.8.1-12.8.2-12.8.3-12.8.4-12.8.4-22.8.5-12.9.0-12.9.1-12.9.10-12.9.11-12.9.12-12.9.2-12.9.3-12.9.4-12.9.5-12.9.6-12.9.7-12.9.8-12.9.9-13.0.0-13.0.1-13.0.10-13.0.11-13.0.2-13.0.3-13.0.4-13.0.5-13.0.6-13.0.6-23.0.6-33.0.7-1
 None known
haproxy
Debian:13
 before 2.9.11-1
2.9.11-1
haproxy
Debian:14
 before 2.9.11-1
2.9.11-1
haproxy
openEuler:24.03-LTS
 before 2.9.5-5.oe2403
2.9.5-5.oe2403
haproxy
openSUSE:Tumbleweed
 before 3.0.5+git0.8e879a52e-2.1
3.0.5+git0.8e879a52e-2.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-49214 is a medium vulnerability (CVSS 5.3) in haproxy, published October 14, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in haproxy 2.4.24-1.

References

Show 8 moreShow less
This page doesn't list everything

Left out here: 58 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open