{"id":"CVE-2022-0711","aliases":["ALPINE-CVE-2022-0711","AZL-8899","BIT-haproxy-2022-0711","DEBIAN-CVE-2022-0711","DSA-5102-1","EUVD-2022-15786","GHSA-x4fc-x944-v9p7","OESA-2022-1578","OESA-2022-2054","RHSA-2022:1021","RHSA-2022:1153","RHSA-2022:1336","RHSA-2022:1620","ROOT-OS-ALPINE-316-CVE-2022-0711","SUSE-SU-2022:2277-1","UBUNTU-CVE-2022-0711","USN-5312-1","openSUSE-SU-2024:11876-1"],"status":"published","title":"A flaw was found in the way HAProxy processed HTTP responses containing the \"Set-Cookie2\" header....","description":"A flaw was found in the way HAProxy processed HTTP responses containing the \"Set-Cookie2\" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.16563,"percentile":0.97029,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2022-03-02T00:00:00Z","modified":"2026-11-03T08:01:45Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"haproxy","fixed_in":["2.2.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"haproxy","fixed_in":["2.2.21-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"haproxy","fixed_in":["2.4.13-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"haproxy","fixed_in":["2.2.21","2.3.18","2.4.13"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"haproxy","fixed_in":["2.4.13-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"haproxy","fixed_in":["2.4.13-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"haproxy","fixed_in":["2.4.13-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"haproxy","fixed_in":["2.2.9-2+deb11u3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"haproxy","fixed_in":["2.2.16-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"haproxy","fixed_in":["2.2.16-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"haproxy","fixed_in":["2.2.16-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"haproxy","fixed_in":["2.4.8-2.oe2203"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.8::el8","package":"haproxy","fixed_in":["0:2.2.13-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.8::el8","package":"haproxy-debugsource","fixed_in":["0:2.2.13-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.8::el8","package":"haproxy22","fixed_in":["0:2.2.13-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.8::el8","package":"haproxy22-debuginfo","fixed_in":["0:2.2.13-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.7::el7","package":"haproxy","fixed_in":["0:2.0.19-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.7::el7","package":"haproxy-debuginfo","fixed_in":["0:2.0.19-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.7::el7","package":"haproxy20","fixed_in":["0:2.0.19-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.7::el8","package":"haproxy","fixed_in":["0:2.0.19-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.7::el8","package":"haproxy-debugsource","fixed_in":["0:2.0.19-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.7::el8","package":"haproxy20","fixed_in":["0:2.0.19-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.7::el8","package":"haproxy20-debuginfo","fixed_in":["0:2.0.19-3.el8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"haproxy","fixed_in":["2.4.8+git0.d1f8d41e0-150400.3.3.13"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"haproxy","fixed_in":["2.4.8+git0.d1f8d41e0-150400.3.3.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"haproxy","fixed_in":["2.0.13-2ubuntu0.5"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"haproxy","fixed_in":["2.5.4+git0.e55ab4208-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.21-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.13-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"haproxy","ranges":[{"type":"SEMVER","events":[{"introduced":"2.2.0"},{"fixed":"2.2.21"},{"introduced":"2.3.0"},{"fixed":"2.3.18"},{"introduced":"2.4.0"},{"fixed":"2.4.13"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.13-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.13-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.13-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-2+deb11u3"}]}],"versions":["2.2.9-2","2.2.9-2+deb11u1","2.2.9-2+deb11u1~bpo10+1","2.2.9-2+deb11u2","2.2.9-2+deb11u2~bpo10+1","2.2.9-2+deb11u3~bpo10+1"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8-2.oe2203"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-4.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-4.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"haproxy22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-4.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"haproxy22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-4.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.1647580879-1.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.13-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.13-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"haproxy22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.13-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"haproxy22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.13-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"haproxy20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"haproxy20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"haproxy20-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el7","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.16-3.el7"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el7","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.16-3.el7"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el7","package":"haproxy20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.16-3.el7"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.16-5.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.16-5.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"haproxy20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.16-5.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"haproxy20-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.16-5.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.1650364520-1.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8+git0.d1f8d41e0-150400.3.3.13"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8+git0.d1f8d41e0-150400.3.3.13"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.13-2ubuntu0.5"}]}],"versions":["2.0.5-1","2.0.8-1","2.0.9-1","2.0.10-1","2.0.10-1ubuntu1","2.0.11-1ubuntu1","2.0.12-1ubuntu2","2.0.13-1ubuntu2","2.0.13-2","2.0.13-2ubuntu0.1","2.0.13-2ubuntu0.2","2.0.13-2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.13-2ubuntu0.5"}]}],"versions":["2.0.5-1","2.0.8-1","2.0.9-1","2.0.10-1","2.0.10-1ubuntu1","2.0.11-1ubuntu1","2.0.12-1ubuntu2","2.0.13-1ubuntu2","2.0.13-2","2.0.13-2ubuntu0.1","2.0.13-2ubuntu0.2","2.0.13-2ubuntu0.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.4+git0.e55ab4208-1.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"haproxy","product":"haproxy"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"openshift_container_platform"},{"vendor":"redhat","product":"software_collections"}],"references":[{"url":"https://access.redhat.com/security/cve/cve-2022-0711","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.mail-archive.com/haproxy%40formilux.org/msg41833.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://github.com/haproxy/haproxy/commit/bfb15ab34ead85f64cd6da0e9fb418c9cd14cee8","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://www.debian.org/security/2022/dsa-5102","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0711","tags":["web","advisory"]},{"url":"https://www.mail-archive.com/haproxy@formilux.org/msg41833.html","tags":["article"]},{"url":"https://github.com/advisories/GHSA-x4fc-x944-v9p7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-0711","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0711.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-0711","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1578","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2054","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1021","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053666","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055733","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055734","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055787","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055788","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055789","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055792","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055795","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055797","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055798","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055802","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055804","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1021.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0711","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0711","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25173","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25173","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25173","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25174","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25174","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25174","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25175","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25175","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25175","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25176","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25176","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25176","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25177","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25177","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25177","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25178","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25178","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25178","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25179","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25179","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25179","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25180","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25180","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25180","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25181","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25181","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25181","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25182","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25182","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25182","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25183","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25183","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25183","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25184","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25184","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25184","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1153","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1153.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1336","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1336.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1620","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1620.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222277-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1196408","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0711","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-0711","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5312-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-0711","description":"A flaw was found in the way HAProxy processed HTTP responses containing the \"Set-Cookie2\" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.","status":"published","published":"2022-03-02T21:59:03Z","modified":"2024-08-02T23:40:03.518Z","cwes":["CWE-835"],"updated_at":"2026-11-02T14:34:42.028422Z"}],"euvd":[{"id":"EUVD-2022-15786","description":"A flaw was found in the way HAProxy processed HTTP responses containing the \"Set-Cookie2\" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.","status":"published","published":"2022-03-02T21:59:03Z","modified":"2024-08-02T23:40:03Z","updated_at":"2026-11-03T03:26:03.912978Z"}],"ghsa":[{"id":"GHSA-x4fc-x944-v9p7","title":"A flaw was found in the way HAProxy processed HTTP responses containing the \"Set-Cookie2\" header....","description":"A flaw was found in the way HAProxy processed HTTP responses containing the \"Set-Cookie2\" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.","status":"published","published":"2022-03-03T00:00:47Z","modified":"2023-02-03T05:06:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:53:53.309122Z"}],"nvd":[{"id":"CVE-2022-0711","description":"A flaw was found in the way HAProxy processed HTTP responses containing the \"Set-Cookie2\" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.","status":"published","published":"2022-03-02T22:15:08.313Z","modified":"2026-06-17T04:21:06.57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:07:12.711288Z"}],"osv":[{"id":"ALPINE-CVE-2022-0711","description":"A flaw was found in the way HAProxy processed HTTP responses containing the \"Set-Cookie2\" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.","status":"published","published":"2022-03-02T22:15:08.313Z","modified":"2026-11-03T07:18:33.006582377Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:51:12.284675Z"},{"id":"AZL-8899","title":"CVE-2022-0711 affecting package haproxy for versions less than 2.4.13-1","description":"A flaw was found in the way HAProxy processed HTTP responses containing the \"Set-Cookie2\" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.","status":"published","published":"2022-03-02T22:15:08Z","modified":"2026-04-21T04:34:55.624895Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:11.069402Z"},{"id":"DEBIAN-CVE-2022-0711","description":"A flaw was found in the way HAProxy processed HTTP responses containing the \"Set-Cookie2\" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.","status":"published","published":"2022-03-02T22:15:08.313Z","modified":"2026-11-03T08:01:45.88385983Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"OESA-2022-1578","title":"haproxy security update","description":"HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the way HAProxy processed HTTP responses containing the \u0026quot;Set-Cookie2\u0026quot; header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.(CVE-2022-0711)","status":"published","published":"2022-03-19T11:04:51Z","modified":"2026-08-18T01:15:43.161600846Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"OESA-2022-2054","title":"haproxy security update","description":"HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones. \r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the way HAProxy processed HTTP responses containing the \u0026quot;Set-Cookie2\u0026quot; header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.(CVE-2022-0711)","status":"published","published":"2022-11-11T11:05:22Z","modified":"2026-08-18T01:17:21.547057801Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"RHSA-2022:1021","title":"Red Hat Security Advisory: OpenShift Container Platform 4.9.26 security update","status":"published","published":"2024-09-16T07:44:42Z","modified":"2026-03-21T10:30:37.749907Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:1153","title":"Red Hat Security Advisory: OpenShift Container Platform 4.8.36 security update","status":"published","published":"2024-09-16T07:44:50Z","modified":"2025-11-22T12:31:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:1336","title":"Red Hat Security Advisory: OpenShift Container Platform 4.7.49 security update","status":"published","published":"2024-09-16T07:44:58Z","modified":"2025-11-22T12:32:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:1620","title":"Red Hat Security Advisory: OpenShift Container Platform 4.6.57 packages and security update","status":"published","published":"2024-09-16T07:45:06Z","modified":"2026-03-21T10:30:37.643029Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"UBUNTU-CVE-2022-0711","description":"A flaw was found in the way HAProxy processed HTTP responses containing the \"Set-Cookie2\" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.","status":"published","published":"2022-03-02T00:00:00Z","modified":"2026-02-04T02:57:48.088305Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:51.630172Z"},{"id":"BIT-haproxy-2022-0711","description":"A flaw was found in the way HAProxy processed HTTP responses containing the \"Set-Cookie2\" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.","status":"published","published":"2024-03-06T10:54:04.395Z","modified":"2026-09-08T08:47:51.486302394Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"CVE-2022-0711","description":"A flaw was found in the way HAProxy processed HTTP responses containing the \"Set-Cookie2\" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.","status":"published","published":"2022-03-02T21:59:03Z","modified":"2026-11-02T07:26:43.239482754Z","cwes":["CWE-835"],"updated_at":"2026-11-02T15:44:22.824781Z"},{"id":"DSA-5102-1","title":"haproxy - security update","status":"published","published":"2022-03-13T00:00:00Z","modified":"2026-03-09T02:10:13.088529Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"openSUSE-SU-2024:11876-1","title":"haproxy-2.5.4+git0.e55ab4208-1.1 on GA media","description":"These are all security issues fixed in the haproxy-2.5.4+git0.e55ab4208-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:08:19.674465Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"ROOT-OS-ALPINE-316-CVE-2022-0711","title":"CVE-2022-0711 in rootio-haproxy - Patched by Root","description":"Root has patched CVE-2022-0711 in the rootio-haproxy package for Root:Alpine:3.16. Multiple fixed versions available.","status":"withdrawn","published":"2025-08-12T08:23:12Z","modified":"2026-10-13T13:00:05.643589773Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"SUSE-SU-2022:2277-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\n- CVE-2022-0711: haproxy: Denial of service via set-cookie2 header (bsc#1196408).\n","status":"published","published":"2022-07-06T03:33:53Z","modified":"2026-02-04T03:22:27.865589Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"USN-5312-1","title":"haproxy vulnerability","description":"It was discovered that HAProxy incorrectly handled certain headers. A\nremote attacker could possibly use this issue to cause HAProxy to stop\nresponding, resulting in a denial of service.\n","status":"published","published":"2022-03-03T13:18:40Z","modified":"2026-02-10T04:42:30Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}