{"id":"CVE-2024-45506","aliases":["AZL-48668","BIT-haproxy-2024-45506","DEBIAN-CVE-2024-45506","EUVD-2024-41515","GHSA-gmvf-rv8w-2hrh","OESA-2024-2130","UBUNTU-CVE-2024-45506","openSUSE-SU-2024:14307-1"],"status":"published","title":"HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote...","description":"HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01203,"percentile":0.68497,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2024-09-04T00:00:00Z","modified":"2026-11-05T21:30:23Z","fixes":[{"ecosystem":"Azure Linux:3","package":"haproxy","fixed_in":["2.9.11-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"haproxy","fixed_in":["2.9.10","3.0.4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"haproxy","fixed_in":["2.9.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"haproxy","fixed_in":["2.9.10-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"haproxy","fixed_in":["2.9.5-4.oe2403"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"haproxy","fixed_in":["3.0.4+git0.7a59afa93-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.11-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"haproxy","ranges":[{"type":"SEMVER","events":[{"introduced":"2.9.0"},{"fixed":"2.9.10"},{"introduced":"3.0.0"},{"fixed":"3.0.4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10-1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.5-4.oe2403"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4+git0.7a59afa93-1.1"}]}]}],"products":[{"vendor":"haproxy","product":"haproxy"}],"references":[{"url":"https://www.haproxy.org/","tags":["Product","web"]},{"url":"https://www.haproxy.org/download/3.1/src/CHANGELOG","tags":["Release Notes","article","web","report"]},{"url":"https://www.mail-archive.com/haproxy%40formilux.org/msg45281.html","tags":["Release Notes","article","web","report"]},{"url":"https://www.mail-archive.com/haproxy%40formilux.org/msg45280.html","tags":["Release Notes","article","web","report"]},{"url":"http://git.haproxy.org/?p=haproxy-3.0.git%3Ba=commitdiff%3Bh=c725db17e8416ffb3c1537aea756356228ce5e3c","tags":["Broken Link","web"]},{"url":"http://git.haproxy.org/?p=haproxy-3.0.git%3Ba=commitdiff%3Bh=d636e515453320c6e122c313c661a8ac7d387c7f","tags":["Broken Link","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45506","tags":["web","advisory"]},{"url":"https://www.haproxy.org"},{"url":"https://github.com/advisories/GHSA-gmvf-rv8w-2hrh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45506.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-45506","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2130","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-45506","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-45506","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45506","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-45506","description":"HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.","status":"published","published":"2024-09-04T00:00:00Z","modified":"2025-03-14T19:16:38.99Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:34:08.16279Z"}],"euvd":[{"id":"EUVD-2024-41515","description":"HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.","status":"published","published":"2024-09-04T00:00:00Z","modified":"2025-03-14T19:16:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:53:02.719002Z"}],"ghsa":[{"id":"GHSA-gmvf-rv8w-2hrh","title":"HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote...","description":"HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service.","status":"published","published":"2024-09-04T15:30:35Z","modified":"2025-03-14T21:32:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:00:17.776608Z"}],"nvd":[{"id":"CVE-2024-45506","description":"HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.","status":"published","published":"2024-09-04T15:15:14.08Z","modified":"2026-06-17T07:54:20.28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:10:24.514378Z"}],"osv":[{"id":"AZL-48668","title":"CVE-2024-45506 affecting package haproxy for versions less than 2.9.11-1","description":"HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.","status":"published","published":"2024-09-04T15:15:14Z","modified":"2026-04-21T04:49:46.277841Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"CVE-2024-45506","description":"HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.","status":"published","published":"2024-09-04T00:00:00Z","modified":"2026-11-06T10:46:28.393915252Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-06T11:08:56.30741Z"},{"id":"DEBIAN-CVE-2024-45506","description":"HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.","status":"published","published":"2024-09-04T15:15:14.08Z","modified":"2026-11-02T12:02:49.071843348Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:43.473331Z"},{"id":"OESA-2024-2130","title":"haproxy security update","description":"HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world\u0026apos;s most visited ones.\r\n\r\nSecurity Fix(es):\r\n\r\nHAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service.(CVE-2024-45506)","status":"published","published":"2024-09-14T11:07:36Z","modified":"2026-08-18T01:18:36.923485527Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"UBUNTU-CVE-2024-45506","description":"HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.","status":"withdrawn","published":"2024-09-04T15:15:00Z","modified":"2025-07-16T07:47:40.305624Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:02.636559Z"},{"id":"BIT-haproxy-2024-45506","description":"HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.","status":"published","published":"2025-09-11T08:41:13.898Z","modified":"2026-09-08T08:47:52.052811372Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"openSUSE-SU-2024:14307-1","title":"haproxy-3.0.4+git0.7a59afa93-1.1 on GA media","description":"These are all security issues fixed in the haproxy-3.0.4+git0.7a59afa93-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-09-04T00:00:00Z","modified":"2026-02-04T02:14:00.584965Z","updated_at":"2026-11-02T16:58:36.662953Z"}]}}