CVE-2023-0836 Information disclosure in HAProxy
An attacker can read uninitialized memory from HAProxy connection buffers, potentially disclosing sensitive data to FastCGI backends.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-0836?
CVE-2023-0836 is a high-severity vulnerability in HAProxy, published on 29 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.
Which versions are affected by CVE-2023-0836?
1 open source package ship an affected version, including haproxy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
haproxy Bitnami | From 2.1.0 | 2.1.1, 2.2.27, 2.3.1, 2.4.22, 2.5.12, 2.6.9, 2.7.1 |
Linux distribution packages (4)
haproxy AlmaLinux:9 | All versions | 2.4.22-1.el9 |
haproxy Red Hat:enterprise_linux:9::appstream | All versions | 0:2.4.22-1.el9 |
haproxy-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:2.4.22-1.el9 |
haproxy-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:2.4.22-1.el9 |
Products include Haproxy Haproxy.
How do I fix CVE-2023-0836?
Upgrade haproxy to a fixed version for your release line: 2.1.1, 2.2.27, 2.3.1 or 2.4.22.
Is CVE-2023-0836 being exploited?
There is no known exploitation of CVE-2023-0836 in the wild and no public exploit code.
Other vulnerabilities in HAProxy
Sources
Also known as ALSA-2023:6496, BIT-haproxy-2023-0836, CLSA-2025-1736284126, DEBIAN-CVE-2023-0836, DSA-5388-1, GHSA-xhfw-qhxr-hjhq and 3 more.