CVE-2024-45506 Denial of service in n/a

What is CVE-2024-45506?

CVE-2024-45506 is a high-severity denial of service vulnerability in n/a, published on 4 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.

Weakness: CWE-835

Which versions are affected by CVE-2024-45506?

1 open source package ship an affected version, including haproxy. It affects 1 product.

Products include Haproxy Haproxy.

How do I fix CVE-2024-45506?

Upgrade haproxy to a fixed version for your release line: 2.9.10 or 3.0.4.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-45506 being exploited?

There is no known exploitation of CVE-2024-45506 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-55203 HAProxy - Integer Overflow in FCGI Demux Record Length Field Critical 9.0
• CVE-2026-55204 HAProxy - NULL Pointer Dereference in hpack_dht_insert Function High 8.7
• CVE-2023-45539 Information disclosure in n/a High 8.2
• CVE-2023-0836 Information disclosure in HAProxy High 7.5
• CVE-2019-18277 Other in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-48668, BIT-haproxy-2024-45506, DEBIAN-CVE-2024-45506, GHSA-gmvf-rv8w-2hrh, OESA-2024-2130, openSUSE-SU-2024:14307-1.