{"id":"CVE-2023-45539","aliases":["ALSA-2024:1142","ALSA-2024:8849","AZL-32061","BIT-haproxy-2023-45539","CLSA-2023-1703008559","CLSA-2023-1703181305","CLSA-2023-1703181677","CLSA-2023-1703183093","CLSA-2023-1703183930","CLSA-2023-1703611617","CLSA-2024-1730920903","CLSA-2026-1776342757","CLSA-2026-1776343034","CLSA-2026-1790671238","DEBIAN-CVE-2023-45539","DLA-3688-1","DSA-5590-1","EUVD-2023-49831","GHSA-79q7-m98p-qvhp","OESA-2023-1886","OESA-2023-1918","OESA-2023-1919","RHSA-2024:10267","RHSA-2024:10271","RHSA-2024:1089","RHSA-2024:1142","RHSA-2024:4853","RHSA-2024:6412","RHSA-2024:8849","RHSA-2024:8874","RHSA-2024:9945","RLSA-2024:8849","SUSE-SU-2023:4645-1","SUSE-SU-2023:4646-1","SUSE-SU-2023:4647-1","SUSE-SU-2024:2377-1","UBUNTU-CVE-2023-45539","USN-6530-1","USN-6530-2"],"status":"published","title":"HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers...","description":"HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01514,"percentile":0.74709,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-116"],"published":"2023-11-28T00:00:00Z","modified":"2026-11-02T02:30:37Z","exploits":[{"source":"pocgithub","id":"slicingmelon/HAProxy-CVE-2023-45539-PoC","title":"slicingmelon/HAProxy-CVE-2023-45539-PoC","date":"2025-08-27","url":"https://github.com/slicingmelon/HAProxy-CVE-2023-45539-PoC"}],"fixes":[{"ecosystem":"AlmaLinux:8","package":"haproxy","fixed_in":["1.8.27-5.el8_10.1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"haproxy","fixed_in":["2.4.24-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"haproxy","fixed_in":["2.8.2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"haproxy","fixed_in":["1.6.3-1ubuntu0.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"haproxy-doc","fixed_in":["1.6.3-1ubuntu0.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-haproxy","fixed_in":["1.6.3-1ubuntu0.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"haproxy","fixed_in":["1.8.27-2.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"haproxy","fixed_in":["1.8.27-2.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"haproxy","fixed_in":["1.5.18-1.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"haproxy","fixed_in":["1.5.18-1.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"haproxy","fixed_in":["1.8.8-1ubuntu0.13.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"haproxy-doc","fixed_in":["1.8.8-1ubuntu0.13.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-haproxy","fixed_in":["1.8.8-1ubuntu0.13.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"haproxy","fixed_in":["1.8.27-5.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"haproxy","fixed_in":["1.5.18-9.el7_9.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"haproxy","fixed_in":["1.5.18-9.el7_9.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"haproxy","fixed_in":["1.5.18-9.el7_9.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"haproxy","fixed_in":["2.6.12-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"haproxy","fixed_in":["2.6.15-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"haproxy","fixed_in":["2.6.15-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"haproxy","fixed_in":["1.8.19-1+deb10u5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"haproxy","fixed_in":["0:1.8.27-5.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"haproxy-debuginfo","fixed_in":["0:1.8.27-5.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"haproxy-debugsource","fixed_in":["0:1.8.27-5.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"haproxy","fixed_in":["0:1.8.27-2.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"haproxy-debuginfo","fixed_in":["0:1.8.27-2.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"haproxy-debugsource","fixed_in":["0:1.8.27-2.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"haproxy","fixed_in":["0:1.8.27-2.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"haproxy-debuginfo","fixed_in":["0:1.8.27-2.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"haproxy-debugsource","fixed_in":["0:1.8.27-2.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"haproxy","fixed_in":["0:1.8.27-2.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"haproxy-debuginfo","fixed_in":["0:1.8.27-2.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"haproxy-debugsource","fixed_in":["0:1.8.27-2.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"haproxy","fixed_in":["0:1.8.27-5.el8_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"haproxy-debuginfo","fixed_in":["0:1.8.27-5.el8_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"haproxy-debugsource","fixed_in":["0:1.8.27-5.el8_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"haproxy","fixed_in":["0:1.8.27-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"haproxy-debuginfo","fixed_in":["0:1.8.27-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"haproxy-debugsource","fixed_in":["0:1.8.27-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"haproxy","fixed_in":["0:1.8.27-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"haproxy-debuginfo","fixed_in":["0:1.8.27-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"haproxy-debugsource","fixed_in":["0:1.8.27-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"haproxy","fixed_in":["0:1.8.27-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"haproxy-debuginfo","fixed_in":["0:1.8.27-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"haproxy-debugsource","fixed_in":["0:1.8.27-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"haproxy","fixed_in":["0:1.8.23-3.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"haproxy-debuginfo","fixed_in":["0:1.8.23-3.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"haproxy-debugsource","fixed_in":["0:1.8.23-3.el8_2.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"haproxy","fixed_in":["0:1.8.27-5.el8_10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"haproxy","fixed_in":["2.0.31-150200.11.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"haproxy","fixed_in":["2.0.31-150200.11.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"haproxy","fixed_in":["2.4.22+git0.f8e3218e2-150400.3.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"haproxy","fixed_in":["2.4.22+git0.f8e3218e2-150400.3.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"haproxy","fixed_in":["2.4.22+git0.f8e3218e2-150400.3.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"haproxy","fixed_in":["2.4.22+git0.f8e3218e2-150400.3.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP5","package":"haproxy","fixed_in":["2.4.22+git0.f8e3218e2-150400.3.19.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"haproxy","fixed_in":["2.4.22+git0.f8e3218e2-150400.3.19.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.4","package":"haproxy","fixed_in":["2.4.22+git0.f8e3218e2-150400.3.19.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"haproxy","fixed_in":["2.4.22+git0.f8e3218e2-150400.3.19.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"haproxy","fixed_in":["2.4.22+git0.f8e3218e2-150400.3.19.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"haproxy","fixed_in":["1.6.3-1ubuntu0.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"haproxy","fixed_in":["1.8.8-1ubuntu0.13+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"haproxy","fixed_in":["2.0.31-0ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"haproxy","fixed_in":["2.4.22-0ubuntu0.22.04.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22-3.el9_3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-5.el8_10.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.24-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"haproxy","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.8.2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1ubuntu0.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"haproxy-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1ubuntu0.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1ubuntu0.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-2.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-2.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.18-1.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.18-1.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1ubuntu0.13.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"haproxy-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1ubuntu0.13.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1ubuntu0.13.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-5.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.18-9.el7_9.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.18-9.el7_9.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.18-9.el7_9.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.12-1+deb12u1"}]}],"versions":["2.6.12-1"]},{"source":"osv","ecosystem":"Debian:13","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.15-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.15-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.19-1+deb10u5"}]}],"versions":["1.8.19-1","1.8.19-1+deb10u1","1.8.19-1+deb10u2","1.8.19-1+deb10u2~bpo9+1","1.8.19-1+deb10u3","1.8.19-1+deb10u4"]},{"source":"osv","ecosystem":"Debian:11","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-2+deb11u6"}]}],"versions":["2.2.9-2","2.2.9-2+deb11u1","2.2.9-2+deb11u1~bpo10+1","2.2.9-2+deb11u2","2.2.9-2+deb11u2~bpo10+1","2.2.9-2+deb11u3","2.2.9-2+deb11u3~bpo10+1","2.2.9-2+deb11u4","2.2.9-2+deb11u5"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.12-1+deb12u1"}]}],"versions":["2.6.12-1"],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-7.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-7.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8-6.oe2203"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-8.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-8.oe2203sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-5.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-5.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-5.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-2.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-2.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-2.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-2.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-2.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-2.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-2.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-2.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-2.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.17-6.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.17-6.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.17-6.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-3.el9_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-3.el9_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-3.el9_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.13-4.rhaos4.15.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.13-4.rhaos4.15.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"haproxy26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.13-4.rhaos4.15.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"haproxy26-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.13-4.rhaos4.15.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-catatonit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-catatonit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-gvproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"podman-gvproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-26.2.rhaos4.15.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0-202409041843.p0.g03a907c.assembly.stream.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0-202409041843.p0.g03a907c.assembly.stream.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0-202409041843.p0.g03a907c.assembly.stream.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0-202409041843.p0.g03a907c.assembly.stream.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.13-4.rhaos4.14.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.13-4.rhaos4.14.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"haproxy26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.13-4.rhaos4.14.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"haproxy26-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.13-4.rhaos4.14.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-5.el8_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-5.el8_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-5.el8_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.23-3.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.23-3.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.23-3.el8_2.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-5.el8_10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.31-150200.11.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.31-150200.11.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.31-150100.8.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP5","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.19.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.19.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.19.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.19.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.19.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1ubuntu0.3+esm1"}]}],"versions":["1.5.14-1","1.5.15-1","1.6.2-1","1.6.2-2","1.6.2-2ubuntu1","1.6.2-2ubuntu3","1.6.3-1","1.6.3-1ubuntu0.1","1.6.3-1ubuntu0.2","1.6.3-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1ubuntu0.13+esm2"}]}],"versions":["1.7.9-1ubuntu1","1.7.9-1ubuntu2","1.8.4-1","1.8.7-1","1.8.8-1","1.8.8-1ubuntu0.1","1.8.8-1ubuntu0.2","1.8.8-1ubuntu0.3","1.8.8-1ubuntu0.4","1.8.8-1ubuntu0.6","1.8.8-1ubuntu0.7","1.8.8-1ubuntu0.8","1.8.8-1ubuntu0.9","1.8.8-1ubuntu0.10","1.8.8-1ubuntu0.11","1.8.8-1ubuntu0.13"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.31-0ubuntu0.3"}]}],"versions":["2.0.5-1","2.0.8-1","2.0.9-1","2.0.10-1","2.0.10-1ubuntu1","2.0.11-1ubuntu1","2.0.12-1ubuntu2","2.0.13-1ubuntu2","2.0.13-2","2.0.13-2ubuntu0.1","2.0.13-2ubuntu0.2","2.0.13-2ubuntu0.3","2.0.13-2ubuntu0.5","2.0.29-0ubuntu1","2.0.29-0ubuntu1.1","2.0.29-0ubuntu1.3","2.0.31-0ubuntu0.1","2.0.31-0ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22-0ubuntu0.22.04.3"}]}],"versions":["2.2.9-2ubuntu2","2.4.8-1","2.4.8-2ubuntu3","2.4.11-1ubuntu1","2.4.12-1ubuntu1","2.4.12-1ubuntu2","2.4.13-1ubuntu1","2.4.14-1ubuntu1","2.4.18-0ubuntu1","2.4.18-0ubuntu1.1","2.4.18-0ubuntu1.2","2.4.18-0ubuntu1.3","2.4.22-0ubuntu0.22.04.1","2.4.22-0ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.31-0ubuntu0.3"}]}],"versions":["2.0.5-1","2.0.8-1","2.0.9-1","2.0.10-1","2.0.10-1ubuntu1","2.0.11-1ubuntu1","2.0.12-1ubuntu2","2.0.13-1ubuntu2","2.0.13-2","2.0.13-2ubuntu0.1","2.0.13-2ubuntu0.2","2.0.13-2ubuntu0.3","2.0.13-2ubuntu0.5","2.0.29-0ubuntu1","2.0.29-0ubuntu1.1","2.0.29-0ubuntu1.3","2.0.31-0ubuntu0.1","2.0.31-0ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22-0ubuntu0.22.04.3"}]}],"versions":["2.2.9-2ubuntu2","2.4.8-1","2.4.8-2ubuntu3","2.4.11-1ubuntu1","2.4.12-1ubuntu1","2.4.12-1ubuntu2","2.4.13-1ubuntu1","2.4.14-1ubuntu1","2.4.18-0ubuntu1","2.4.18-0ubuntu1.1","2.4.18-0ubuntu1.2","2.4.18-0ubuntu1.3","2.4.22-0ubuntu0.22.04.1","2.4.22-0ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1ubuntu0.3+esm1"}]}],"versions":["1.5.14-1","1.5.15-1","1.6.2-1","1.6.2-2","1.6.2-2ubuntu1","1.6.2-2ubuntu3","1.6.3-1","1.6.3-1ubuntu0.1","1.6.3-1ubuntu0.2","1.6.3-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1ubuntu0.13+esm2"}]}],"versions":["1.7.9-1ubuntu1","1.7.9-1ubuntu2","1.8.4-1","1.8.7-1","1.8.8-1","1.8.8-1ubuntu0.1","1.8.8-1ubuntu0.2","1.8.8-1ubuntu0.3","1.8.8-1ubuntu0.4","1.8.8-1ubuntu0.6","1.8.8-1ubuntu0.7","1.8.8-1ubuntu0.8","1.8.8-1ubuntu0.9","1.8.8-1ubuntu0.10","1.8.8-1ubuntu0.11","1.8.8-1ubuntu0.13"]}],"products":[{"vendor":"haproxy","product":"haproxy"}],"references":[{"url":"https://lists.w3.org/Archives/Public/ietf-http-wg/2023JulSep/0070.html","tags":["x_transferred","Mailing List","discussion","web","report"]},{"url":"https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=2eab6d354322932cfec2ed54de261e4347eca9a6","tags":["x_transferred","Broken Link","web"]},{"url":"https://www.mail-archive.com/haproxy%40formilux.org/msg43861.html","tags":["x_transferred","Release Notes","article","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00010.html","tags":["mailing-list","x_transferred","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45539","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-79q7-m98p-qvhp"},{"url":"https://access.redhat.com/errata/RHSA-2024:1142","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40225","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45539","tags":["report"]},{"url":"https://bugzilla.redhat.com/2231370","tags":["report"]},{"url":"https://bugzilla.redhat.com/2253037","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-1142.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:8849","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-8849.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04-els/CLSA-2023-1703008559","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2023-1703181305.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2023-1703181677.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2023-1703183093.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2023-1703183930.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18_04-els/CLSA-2023-1703611617","tags":["advisory"]},{"url":"https://errata.tuxcare.com/centos8stream-els/CLSA-2024-1730920903.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1776342757.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1776343034.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1790671238.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45539.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-45539","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1886","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0836","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1918","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1919","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10267","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253037","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10267.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45539","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10271","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10271.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1089","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2231370","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1089.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40225","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40225","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1142.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4853","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2294000","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4853.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-6104","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-6104","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6104","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6412","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053532","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6412.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23772","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23772","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23772","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8849.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:8874","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8874.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9945","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9945.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:8849","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234645-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1217653","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45539","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234646-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1214102","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40225","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234647-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242377-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-45539","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6530-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6530-2","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-45539","description":"HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.","status":"published","published":"2023-11-28T00:00:00Z","modified":"2024-10-15T17:44:03.661Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:35:22.984825Z"}],"euvd":[{"id":"EUVD-2023-49831","description":"HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.","status":"published","published":"2023-11-28T00:00:00Z","modified":"2024-10-15T17:44:03Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-03T00:27:36.689661Z"}],"ghsa":[{"id":"GHSA-79q7-m98p-qvhp","title":"HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers...","description":"HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.","status":"published","published":"2023-11-28T21:30:25Z","modified":"2024-10-15T21:30:33Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:58:30.303503Z"}],"nvd":[{"id":"CVE-2023-45539","description":"HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.","status":"published","published":"2023-11-28T20:15:07.817Z","modified":"2026-06-17T06:28:48.303Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:08:49.393375Z"}],"osv":[{"id":"AZL-32061","title":"CVE-2023-45539 affecting package haproxy for versions less than 2.4.24-1","description":"HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.","status":"published","published":"2023-11-28T20:15:07Z","modified":"2026-04-21T04:26:38.192592Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"CVE-2023-45539","description":"HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.","status":"published","published":"2023-11-28T00:00:00Z","modified":"2026-11-02T02:30:37.495307658Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"DEBIAN-CVE-2023-45539","description":"HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.","status":"published","published":"2023-11-28T20:15:07.817Z","modified":"2026-10-26T18:02:49.4129131Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"OESA-2023-1886","title":"haproxy security update","description":"HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world\u0026apos;s most visited ones.\r\n\r\nSecurity Fix(es):\r\n\r\nAn information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.(CVE-2023-0836)\r\n\r\nHAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.(CVE-2023-45539)","status":"published","published":"2023-12-08T11:06:19Z","modified":"2026-08-18T01:18:04.303622847Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2023-1918","title":"haproxy security update","description":"HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world\u0026apos;s most visited ones.\r\n\r\nSecurity Fix(es):\r\n\r\nAn information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.(CVE-2023-0836)\r\n\r\nHAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.(CVE-2023-45539)","status":"published","published":"2023-12-15T11:06:21Z","modified":"2026-08-18T01:18:05.788996225Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2023-1919","title":"haproxy security update","description":"HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world\u0026apos;s most visited ones.\r\n\r\nSecurity Fix(es):\r\n\r\nAn information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.(CVE-2023-0836)\r\n\r\nHAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.(CVE-2023-45539)","status":"published","published":"2023-12-15T11:06:21Z","modified":"2026-08-18T01:18:05.595821222Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"RHSA-2024:10267","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2024-11-26T08:23:17Z","modified":"2026-03-18T11:36:31.790557Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:10271","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2024-11-26T08:23:28Z","modified":"2026-03-18T11:36:30.441568Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1089","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2024-09-16T17:36:50Z","modified":"2026-08-05T10:17:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1142","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2024-09-16T17:37:00Z","modified":"2026-08-05T10:18:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:4853","title":"Red Hat Security Advisory: OpenShift Container Platform 4.15.24 packages and security update","status":"published","published":"2024-10-01T11:02:47Z","modified":"2026-10-16T10:04:56Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:6412","title":"Red Hat Security Advisory: OpenShift Container Platform 4.14.36 security update","status":"published","published":"2024-09-30T12:50:31Z","modified":"2026-06-29T11:01:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:8849","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2024-11-06T07:25:57Z","modified":"2026-03-18T11:36:17.81575Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:8874","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2024-11-06T07:25:24Z","modified":"2026-03-18T11:36:19.204216Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:9945","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2024-11-25T09:52:19Z","modified":"2026-03-18T11:36:30.443583Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"UBUNTU-CVE-2023-45539","description":"HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.","status":"published","published":"2023-12-04T00:00:00Z","modified":"2026-02-04T02:27:22.674458Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"ALSA-2024:1142","title":"Moderate: haproxy security update","description":"The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.\n\nSecurity Fix(es):\n\n* haproxy: Proxy forwards malformed empty Content-Length headers (CVE-2023-40225)\n* haproxy: untrimmed URI fragments may lead to exposure of confidential data on static servers (CVE-2023-45539)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-03-05T00:00:00Z","modified":"2026-10-29T11:32:01.063541758Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:8849","title":"Moderate: haproxy security update","description":"The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.  \n\nSecurity Fix(es):  \n\n  * haproxy: untrimmed URI fragments may lead to exposure of confidential data on static servers (CVE-2023-45539)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-11-05T00:00:00Z","modified":"2026-10-29T11:02:22.101473151Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"BIT-haproxy-2023-45539","description":"HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.","status":"published","published":"2024-03-06T10:52:59.807Z","modified":"2026-09-08T08:47:51.641193084Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"CLSA-2023-1703008559","title":"Fix CVE(s): CVE-2023-45539","description":"\n   * SECURITY UPDATE: Accepting '#' as part of the URI component might\n     allow remote attackers to obtain sensitive information or have\n     unspecified other impact\n     - debian/patches/CVE-2023-45539.patch: h1: do not accept '#' as part\n       of the URI component; h2: reject more chars from the :path pseudo\n       header\n     - CVE-2023-45539","status":"published","published":"2023-12-19T17:56:03Z","modified":"2026-06-04T10:03:30.949663Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2023-1703181305","title":"haproxy: Fix of CVE-2023-45539","description":"- CVE-2023-45539: h1: do not accept '#' as part of the URI component;\n  h2: reject more chars from the :path pseudo header","status":"published","published":"2023-12-21T17:55:10Z","modified":"2026-06-01T00:32:26.640878393Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2023-1703181677","title":"haproxy: Fix of CVE-2023-45539","description":"- CVE-2023-45539: h1: do not accept '#' as part of the URI component;\n  h2: reject more chars from the :path pseudo header","status":"published","published":"2023-12-21T18:01:21Z","modified":"2026-06-01T00:33:22.132830509Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2023-1703183093","title":"haproxy: Fix of CVE-2023-45539","description":"- CVE-2023-45539: do not accept '#' as part of the URI component","status":"published","published":"2023-12-21T18:24:56Z","modified":"2026-06-01T00:32:45.279803719Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2023-1703183930","title":"haproxy: Fix of CVE-2023-45539","description":"- CVE-2023-45539: do not accept '#' as part of the URI component","status":"published","published":"2023-12-21T18:38:54Z","modified":"2026-06-01T00:33:25.056399015Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2023-1703611617","title":"Fix CVE(s): CVE-2023-45539","description":"\n   * SECURITY UPDATE: Accepting '#' as part of the URI component might\n     allow remote attackers to obtain sensitive information or have\n     unspecified other impact\n     - debian/patches/CVE-2023-45539.patch: h1: do not accept '#' as part\n       of the URI component; h2: reject more chars from the :path pseudo\n       header\n     - CVE-2023-45539","status":"published","published":"2023-12-26T17:27:00Z","modified":"2026-06-04T10:03:12.161061Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1730920903","title":"haproxy: Fix of CVE-2023-45539","description":"- Fix CVE-2023-45539: fix potential information disclosure by not\n  accepting '#' as a part of the URI component","status":"published","published":"2024-11-06T19:21:50Z","modified":"2026-06-01T00:32:55.959501459Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2026-1776342757","title":"haproxy: Fix of CVE-2023-45539","description":"- CVE-2023-45539: reject '#' as part of the URI to prevent\n  ACL bypass via path_end rules","status":"published","published":"2026-04-16T12:32:42Z","modified":"2026-06-01T00:32:50.755526589Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1776343034","title":"haproxy: Fix of CVE-2023-45539","description":"- CVE-2023-45539: reject '#' as part of the URI to prevent\n  ACL bypass via path_end rules","status":"published","published":"2026-04-16T12:37:18Z","modified":"2026-06-01T00:33:28.225946784Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1790671238","title":"haproxy: Fix of CVE-2023-45539","description":"- CVE-2023-45539: reject '#' as part of the URI to prevent\n  ACL bypass via path_end rules","status":"published","published":"2026-09-30T16:38:47Z","modified":"2026-10-26T09:31:49.356128686Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"DLA-3688-1","title":"haproxy - security update","status":"published","published":"2023-12-14T00:00:00Z","modified":"2026-03-09T01:21:26.522204Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5590-1","title":"haproxy - security update","status":"published","published":"2023-12-28T00:00:00Z","modified":"2026-03-09T02:10:22.244837Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"RLSA-2024:8849","title":"Moderate: haproxy security update","description":"The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.\n\nSecurity Fix(es):\n\n* haproxy: untrimmed URI fragments may lead to exposure of confidential data on static servers (CVE-2023-45539)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-11-08T15:56:47.559546Z","modified":"2026-02-04T12:45:13.037267Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"SUSE-SU-2023:4645-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\n- CVE-2023-45539: Fixed misinterpretation of a path_end rule with # as part of the URI component (bsc#1217653).\n","status":"published","published":"2023-12-05T23:33:51Z","modified":"2026-02-04T02:49:58.599931Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4646-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\n- CVE-2023-45539: Fixed misinterpretation of a path_end rule with # as part of the URI component (bsc#1217653).\n- CVE-2023-40225: reject any empty content-length header value (bsc#1214102).\n","status":"published","published":"2023-12-06T09:42:35Z","modified":"2026-02-04T02:22:26.978621Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4647-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\n- CVE-2023-45539: Fixed misinterpretation of a path_end rule with # as part of the URI component (bsc#1217653).\n","status":"published","published":"2023-12-06T09:43:04Z","modified":"2026-02-04T04:08:59.348633Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2024:2377-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\n- CVE-2023-45539: Fixed misinterpretation of a path_end rule with # as part of the URI component (bsc#1217653).\n","status":"published","published":"2024-07-09T17:20:53Z","modified":"2026-02-04T02:20:01.53577Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"USN-6530-1","title":"haproxy vulnerability","description":"It was discovered that HAProxy incorrectly handled URI components\ncontaining the hash character (#). A remote attacker could possibly use\nthis issue to obtain sensitive information, or to bypass certain path_end\nrules.\n","status":"published","published":"2023-12-05T13:12:31Z","modified":"2026-02-10T04:43:26Z","updated_at":"2026-11-02T16:58:17.305935Z"},{"id":"USN-6530-2","title":"haproxy vulnerability","description":"Seth Manesse and Paul Plasil discovered that HAProxy incorrectly handled \nURI components containing the hash character (#). A remote attacker could \npossibly use this issue to obtain sensitive information, or to bypass \ncertain path_end rules.\n","status":"published","published":"2024-07-23T16:55:58Z","modified":"2026-06-25T13:31:22.243760987Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}