Skip to content

Haproxy · weakness class

Denial of Service

7 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

likely to be exploited
2

Every one of the 7 is a mark on the map. Named now: 1 to 7, most at risk first.

  1. HAProxy through 2.0.2 allows attackers to cause a denial of service (ha_panic) via vectors related to htx_manage_client_side_cookies in proto_htx.c.CVE-2019-14241Haproxy · 70% likely

    CWE-835

  2. A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lea…CVE-2022-0711Haproxy · 17% likely

    CWE-835

  3. An issue was discovered in dns.c in HAProxy through 1.8.14. In the case of a compressed pointer, a crafted packet can trigger infinite recursion by making the pointer point to its…CVE-2018-20103Haproxy · 6.6% likely

    CWE-835

  4. An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specia…CVE-2023-0056Haproxy · CVSS 6.5 · 1.8% likely

    CWE-400

  5. HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of…CVE-2024-45506Haproxy · CVSS 7.5 · 1.2% likely

    CWE-835

  6. HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although th…CVE-2026-110354HAProxy · CVSS 7.5 · 0.8% likely

    CWE-835

  7. Denial of service vulnerability in HAProxy mjson libraryCVE-2025-11230HAProxy Technologies · CVSS 7.5 · 0.7% likely

    CWE-407

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP

Updated AboutDevelopersSign in