{"id":"CVE-2019-19330","aliases":["ALPINE-CVE-2019-19330","DEBIAN-CVE-2019-19330","DSA-4577-1","EUVD-2019-8951","GHSA-x4px-pm9c-vmjm","RHSA-2020:1287","RHSA-2020:1725","RHSA-2020:1936","RHSA-2020:2265","UBUNTU-CVE-2019-19330","USN-4212-1"],"status":"published","title":"The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by...","description":"The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04032,"percentile":0.90673,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2019-11-27T15:53:26Z","modified":"2026-09-21T07:01:17Z","fixes":[{"ecosystem":"Alpine:v3.8","package":"haproxy","fixed_in":["1.8.23"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"haproxy","fixed_in":["1.8.23-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"haproxy","fixed_in":["2.0.10-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"haproxy","fixed_in":["2.0.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"haproxy","fixed_in":["2.0.10-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"haproxy","fixed_in":["1.8.19-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"haproxy","fixed_in":["1.8.8-1ubuntu0.9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.23"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.23-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.19-1+deb10u1"}]}],"versions":["1.8.19-1"]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.23-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.23-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"haproxy18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.23-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.23-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.23-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.23-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el7","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.13-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el7","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.13-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el7","package":"haproxy20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.13-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.13-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el8","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.13-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el8","package":"haproxy20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.13-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el8","package":"haproxy20-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.13-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-haproxy18-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.24-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-haproxy18-haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.24-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-haproxy18-haproxy-syspaths","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.24-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1ubuntu0.9"}]}],"versions":["1.7.9-1ubuntu1","1.7.9-1ubuntu2","1.8.4-1","1.8.7-1","1.8.8-1","1.8.8-1ubuntu0.1","1.8.8-1ubuntu0.2","1.8.8-1ubuntu0.3","1.8.8-1ubuntu0.4","1.8.8-1ubuntu0.6","1.8.8-1ubuntu0.7","1.8.8-1ubuntu0.8"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1ubuntu0.9"}]}],"versions":["1.7.9-1ubuntu1","1.7.9-1ubuntu2","1.8.4-1","1.8.7-1","1.8.8-1","1.8.8-1ubuntu0.1","1.8.8-1ubuntu0.2","1.8.8-1ubuntu0.3","1.8.8-1ubuntu0.4","1.8.8-1ubuntu0.6","1.8.8-1ubuntu0.7","1.8.8-1ubuntu0.8"]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"haproxy","product":"haproxy"}],"references":[{"url":"https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=54f53ef7ce4102be596130b44c768d1818570344","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=146f53ae7e97dbfe496d0445c2802dd0a30b0878","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://git.haproxy.org/?p=haproxy-2.0.git%3Ba=commit%3Bh=ac198b92d461515551b95daae20954b3053ce87e","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://tools.ietf.org/html/rfc7540#section-10.3","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://www.debian.org/security/2019/dsa-4577","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://seclists.org/bugtraq/2019/Nov/45","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4212-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202004-01","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19330","tags":["advisory"]},{"url":"https://git.haproxy.org/?p=haproxy-2.0.git;a=commit;h=ac198b92d461515551b95daae20954b3053ce87e","tags":["report"]},{"url":"https://git.haproxy.org/?p=haproxy.git;a=commit;h=146f53ae7e97dbfe496d0445c2802dd0a30b0878","tags":["report"]},{"url":"https://git.haproxy.org/?p=haproxy.git;a=commit;h=54f53ef7ce4102be596130b44c768d1818570344","tags":["report"]},{"url":"https://usn.ubuntu.com/4212-1"},{"url":"https://github.com/advisories/GHSA-x4px-pm9c-vmjm"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-19330","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-19330","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1287","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1759697","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1777584","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1819111","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1287.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-18277","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-18277","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18277","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-19330","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-19330","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-11100","tags":["report"]},{"url":"https://access.redhat.com/security/vulnerabilities/haproxy","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11100","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11100","tags":["advisory"]},{"url":"https://bugs.chromium.org/p/project-zero/issues/detail?id=2023","tags":["article"]},{"url":"https://www.haproxy.com/blog/haproxy-1-8-http-2-hpack-decoder-vulnerability-fixed/","tags":["article"]},{"url":"https://www.mail-archive.com/haproxy@formilux.org/msg36876.html","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1725","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.2_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1774745","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1778844","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1725.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1936","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1936.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2265","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_software_collections/3/html/3.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1774747","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2265.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-19330","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4212-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-19330","description":"The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.","status":"published","published":"2019-11-27T15:53:26Z","modified":"2024-08-05T02:16:46.867Z","updated_at":"2026-11-02T14:20:20.74896Z"}],"euvd":[{"id":"EUVD-2019-8951","description":"The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.","status":"published","published":"2019-11-27T15:53:26Z","modified":"2024-08-05T02:16:46Z","updated_at":"2026-11-03T02:40:25.841101Z"}],"ghsa":[{"id":"GHSA-x4px-pm9c-vmjm","title":"The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by...","description":"The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.","status":"published","published":"2022-05-24T17:02:19Z","modified":"2024-04-04T02:41:11Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:56:11.047077Z"}],"nvd":[{"id":"CVE-2019-19330","description":"The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.","status":"published","published":"2019-11-27T16:15:11.72Z","modified":"2026-06-17T02:26:30.81Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:05:38.993437Z"}],"osv":[{"id":"ALPINE-CVE-2019-19330","description":"The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.","status":"published","published":"2019-11-27T16:15:11.72Z","modified":"2026-09-21T06:17:52.507835247Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"CVE-2019-19330","description":"The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.","status":"published","published":"2019-11-27T16:15:11.72Z","modified":"2026-04-10T04:16:21.618031Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:12.010761Z"},{"id":"DEBIAN-CVE-2019-19330","description":"The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.","status":"published","published":"2019-11-27T16:15:11.72Z","modified":"2026-09-21T07:01:17.988912053Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"RHSA-2020:1287","title":"Red Hat Security Advisory: OpenShift Container Platform 3.11 security update","status":"published","published":"2024-09-13T22:02:49Z","modified":"2026-06-28T10:35:41Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:1725","title":"Red Hat Security Advisory: haproxy security, bug fix, and enhancement update","status":"published","published":"2024-09-13T16:17:55Z","modified":"2026-06-29T10:29:51Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:1936","title":"Red Hat Security Advisory: OpenShift Container Platform 4.4.3 haproxy security update","status":"published","published":"2024-09-13T22:03:52Z","modified":"2026-06-28T10:36:29Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2265","title":"Red Hat Security Advisory: rh-haproxy18-haproxy security, bug fix, and enhancement update","status":"published","published":"2024-09-13T16:18:59Z","modified":"2026-06-29T10:30:25Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"UBUNTU-CVE-2019-19330","description":"The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.","status":"published","published":"2019-11-27T16:15:00Z","modified":"2026-02-04T02:22:05.247535Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"DSA-4577-1","title":"haproxy - security update","status":"published","published":"2019-11-28T00:00:00Z","modified":"2026-03-09T02:10:45.934021Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"USN-4212-1","title":"haproxy vulnerability","description":"Tim Düsterhus discovered that HAProxy incorrectly handled certain HTTP/2 headers.\nAn attacker could possibly use this issue to execute arbitrary code through CRLF injection.\n","status":"published","published":"2019-12-04T12:48:05Z","modified":"2026-02-10T04:41:43Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}