{"id":"CVE-2024-49214","aliases":["AZL-50333","BIT-haproxy-2024-49214","DEBIAN-CVE-2024-49214","EUVD-2024-43285","GHSA-8jgf-8r3g-hxh8","OESA-2024-2273","openSUSE-SU-2024:14402-1"],"status":"published","title":"QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening...","description":"QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AC:L/AV:N/A:N/C:N/I:L/PR:N/S:U/UI:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00519,"percentile":0.44608,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-290"],"published":"2024-10-14T00:00:00Z","modified":"2026-11-02T12:02:53Z","fixes":[{"ecosystem":"Azure Linux:2","package":"haproxy","fixed_in":["2.4.24-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"haproxy","fixed_in":["2.9.11","3.0.5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"haproxy","fixed_in":["2.9.11-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"haproxy","fixed_in":["2.9.11-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"haproxy","fixed_in":["2.9.5-5.oe2403"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"haproxy","fixed_in":["3.0.5+git0.8e879a52e-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.24-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"haproxy","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.9.11"},{"introduced":"3.0.0"},{"fixed":"3.0.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.12-1","2.6.12-1+deb12u1","2.6.12-1+deb12u2","2.6.12-1+deb12u3","2.6.12-1+deb12u4","2.6.13-1","2.6.14-1","2.6.15-1","2.7.0-1","2.7.1-1","2.7.2-1","2.7.2-2","2.7.3-1","2.7.4-1","2.7.5-1","2.7.6-1","2.7.7-1","2.7.8-1","2.8.0-1","2.8.1-1","2.8.2-1","2.8.3-1","2.8.4-1","2.8.4-2","2.8.5-1","2.9.0-1","2.9.1-1","2.9.10-1","2.9.11-1","2.9.12-1","2.9.2-1","2.9.3-1","2.9.4-1","2.9.5-1","2.9.6-1","2.9.7-1","2.9.8-1","2.9.9-1","3.0.0-1","3.0.1-1","3.0.10-1","3.0.11-1","3.0.2-1","3.0.3-1","3.0.4-1","3.0.5-1","3.0.6-1","3.0.6-2","3.0.6-3","3.0.7-1","3.0.8-1","3.0.9-1","3.1.0-1","3.1.0-2","3.1.1-1","3.1.2-1","3.1.3-1","3.1.5-1","3.1.6-1","3.1.7-1","3.2.0-1","3.2.1-1","3.2.10-1","3.2.11-1","3.2.11-2","3.2.12-1","3.2.13-1","3.2.14-1","3.2.15-1","3.2.16-1","3.2.17-1","3.2.18-1","3.2.19-1","3.2.20-1","3.2.21-1","3.2.22-1","3.2.23-1","3.2.24-1","3.2.25-1","3.2.26-1","3.2.3-1","3.2.3-2","3.2.4-1","3.2.5-1","3.2.5-2","3.2.6-1","3.2.7-1","3.2.8-1","3.2.9-1","3.3.0-1","3.3.1-1","3.3.10-1","3.3.2-1","3.3.2-2","3.3.3-1","3.3.4-1","3.3.5-1","3.3.6-1","3.3.7-1","3.3.8-1","3.3.9-1","3.4.0-1","3.4.1-1","3.4.2-1","3.4.3-1","3.4.4-1","3.4.6-1","3.4.7-1"]},{"source":"osv","ecosystem":"Debian:13","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.11-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.11-1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.5-5.oe2403"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5+git0.8e879a52e-2.1"}]}]}],"references":[{"url":"https://www.haproxy.org/download/3.1/src/CHANGELOG","tags":["web"]},{"url":"https://github.com/haproxy/haproxy/commit/f627b9272bd8ffca6f2f898bfafc6bf0b84b7d46","tags":["web","fix"]},{"url":"https://www.mail-archive.com/haproxy%40formilux.org/msg45291.html","tags":["web"]},{"url":"https://www.mail-archive.com/haproxy%40formilux.org/msg45314.html","tags":["web"]},{"url":"https://www.mail-archive.com/haproxy%40formilux.org/msg45315.html","tags":["web"]},{"url":"https://www.haproxy.org/download/3.0/src/CHANGELOG","tags":["web"]},{"url":"https://www.haproxy.org/download/2.9/src/CHANGELOG","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49214","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-8jgf-8r3g-hxh8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49214.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-49214","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2273","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/Q6W3TNQBBMGBNGGBK5DYH5DN2UZ5OLES/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49214","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-49214","description":"QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.","status":"published","published":"2024-10-14T00:00:00Z","modified":"2024-10-29T15:16:03.727Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AC:L/AV:N/A:N/C:N/I:L/PR:N/S:U/UI:N","level":"medium","assessor":"cna"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:33:55.977982Z"}],"euvd":[{"id":"EUVD-2024-43285","description":"QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.","status":"published","published":"2024-10-14T00:00:00Z","modified":"2024-10-29T15:16:03Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AC:L/AV:N/A:N/C:N/I:L/PR:N/S:U/UI:N","level":"medium"}],"updated_at":"2026-11-03T00:05:15.24326Z"}],"ghsa":[{"id":"GHSA-8jgf-8r3g-hxh8","title":"QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening...","description":"QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.","status":"published","published":"2024-10-14T06:30:43Z","modified":"2024-10-29T18:30:35Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:58:38.070803Z"}],"nvd":[{"id":"CVE-2024-49214","description":"QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.","status":"published","published":"2024-10-14T04:15:05.853Z","modified":"2026-06-17T07:59:31.297Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:10:31.879321Z"}],"osv":[{"id":"CVE-2024-49214","description":"QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.","status":"published","published":"2024-10-14T00:00:00Z","modified":"2026-10-28T10:54:35.393202237Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AC:L/AV:N/A:N/C:N/I:L/PR:N/S:U/UI:N","level":"medium"}],"updated_at":"2026-11-02T15:44:43.597758Z"},{"id":"DEBIAN-CVE-2024-49214","description":"QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.","status":"published","published":"2024-10-14T04:15:05.853Z","modified":"2026-11-02T12:02:53.070158124Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:43.798789Z"},{"id":"OESA-2024-2273","title":"haproxy security update","description":"HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world\u0026apos;s most visited ones.\r\n\r\nSecurity Fix(es):\r\n\r\nQUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.(CVE-2024-49214)","status":"published","published":"2024-10-18T11:07:45Z","modified":"2026-08-18T01:18:37.40634768Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"AZL-50333","title":"CVE-2024-49214 affecting package haproxy for versions less than 2.4.24-1","description":"QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.","status":"published","published":"2024-10-14T04:15:05Z","modified":"2026-04-21T04:30:11.696323Z","updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"BIT-haproxy-2024-49214","description":"QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.","status":"published","published":"2024-10-22T11:56:51.321Z","modified":"2025-04-03T14:40:37.652Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"openSUSE-SU-2024:14402-1","title":"haproxy-3.0.5+git0.8e879a52e-2.1 on GA media","description":"These are all security issues fixed in the haproxy-3.0.5+git0.8e879a52e-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-10-15T00:00:00Z","modified":"2026-02-04T02:29:07.286738Z","updated_at":"2026-11-02T16:58:36.976155Z"}]}}