Memory Corruption

Every one of the 15 is a mark on the map. Named now: 1 to 15, most at risk first.

1. In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap…CVE-2020-11100Haproxy · 62% likely

   CWE-787

2. An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all confi…CVE-2021-40346Haproxy · 59% likely

   CWE-190

3. HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service (uninitialized memory access and crash) or possibly have un…CVE-2016-5360Haproxy · 43% likely

   CWE-119

4. An issue was discovered in HAProxy before 1.8.8. The incoming H2 frame length was checked against the max_frame_size setting instead of being checked against the bufsize. The max_…CVE-2018-10184Haproxy · 8.1% likely

   CWE-119

5. Buffer overflow in HAProxy 1.4 through 1.4.22 and 1.5-dev through 1.5-dev17, when HTTP keep-alive is enabled, using HTTP keywords in TCP inspection rules, and running with rewrite…CVE-2013-1912Haproxy · 5.6% likely

   CWE-119

6. Buffer overflow in the trash buffer in the header capture functionality in HAProxy before 1.4.21, when global.tune.bufsize is set to a value greater than the default and header re…CVE-2012-2942Haproxy · 5.4% likely

   CWE-119

7. An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder in HAProxy 1.8.x and 1.9.x through 1.9.0 which can result in a crash. The processing of the PRIORITY flag…CVE-2018-20615Haproxy · 4.5% likely

   CWE-125

8. The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attacker…CVE-2015-3281Haproxy · 4.3% likely

   CWE-119

9. An out-of-bounds read in dns_validate_dns_response in dns.c was discovered in HAProxy through 1.8.14. Due to a missing check when validating DNS responses, remote attackers might…CVE-2018-20102Haproxy · 4.2% likely

   CWE-125

10. A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpack_valid_idx() resulted in a remote crash and den…CVE-2018-14645Haproxy · CVSS 7.5 · 3.1% likely

    CWE-125

11. An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and conf…CVE-2026-90678HAProxy · CVSS 7.5 · 0.8% likely

    CWE-130

12. HAProxy - NULL Pointer Dereference in hpack_dht_insert FunctionCVE-2026-55204haproxy · CVSS 7.5 · 0.5% likelycovered by CyberSIXT

    CWE-476

13. HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.CVE-2026-26081HAProxy · CVSS 4.8 · 0.5% likely

    CWE-130

14. HAProxy - Integer Overflow in FCGI Demux Record Length FieldCVE-2026-55203haproxy · CVSS 7.5 · 0.3% likelycovered by CyberSIXT

    CWE-190

15. An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is cl…CVE-2026-33555HAProxy · CVSS 4 · 0.3% likely

    CWE-130

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.