Input Validation and Logic

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. headerv2.go in mastercactapus proxyprotocol before 0.0.2, as used in the mastercactapus caddy-proxyprotocol plugin through 0.0.2 for Caddy, allows remote attackers to cause a deni…CVE-2019-14243Haproxy · 4.3% likely

   CWE-20

2. HAProxy 1.4 before 1.4.24 and 1.5 before 1.5-dev19, when configured to use hdr_ip or other "hdr_*" functions with a negative occurrence count, allows remote attackers to cause a d…CVE-2013-2175Haproxy · 3.6% likely

   CWE-20

3. An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead to a situation with an attacker-controlled HTTP Host header, because a m…CVE-2021-39242Haproxy · 2.2% likely

   CWE-755

4. HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling of the replacement of multiple short patt…CVE-2025-32464HAProxy · CVSS 6.8 · 0.8% likely

   CWE-1025

5. HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in…CVE-2026-110353HAProxy · CVSS 7.5 · 0.7% likely

   CWE-252

6. HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.CVE-2026-26080HAProxy · CVSS 3.7 · 0.5% likely

   CWE-252

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.