CVE-2024-45506

A flaw was found in HAProxy. An issue in the HTTP/2 multiplexer combined with the zero-copy forwarding system allows remote attackers to trigger under very rare conditions an endless loop and cause a denial of service.

The severity of this vulnerability has been raised to Important due to preliminary evidence from the upstream HAProxy project that it has been exploited in one case. Without this detail, the technical risk from this type of denial of service would have been rated Moderate.

This issue can only be triggered when zero-copy forwarding of data is enabled. See the mitigation section to see how this mechanism can be disabled.

The HAProxy package as shipped in Red Hat Enterprise Linux 7, 8, 9, in Red Hat Ceph Storage 5 and in Red Hat OpenShift Container Platform 3.11 and 4 is not affected by this vulnerability because these products do not ship a vulnerable version of HAProxy.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.