CVE-2025-32464 Memory corruption in HAProxy
Heap-based buffer overflow in HAProxy allows attackers to execute code or cause denial of service in specific configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-32464?
CVE-2025-32464 is a medium-severity memory corruption vulnerability in HAProxy, published on 9 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling of the replacement of multiple short patterns with a longer one.
Weakness: CWE-1025
Which versions are affected by CVE-2025-32464?
1 open source package ship an affected version, including haproxy.
| Package | Affected | Fixed in |
|---|---|---|
haproxy Bitnami | From 2.2.0 | 2.9.6, 3.1.7 |
Linux distribution packages (8)
haproxy SUSE:Linux Enterprise High Availability Extension 15 SP4 | All versions | 2.4.22+git0.f8e3218e2-150400.3.22.1 |
haproxy SUSE:Linux Enterprise High Availability Extension 15 SP5 | All versions | 2.4.22+git0.f8e3218e2-150400.3.22.1 |
haproxy SUSE:Linux Enterprise High Availability Extension 15 SP6 | All versions | 2.8.11+git0.01c1056a4-150600.3.6.1 |
haproxy SUSE:Linux Enterprise Micro 5.3 | All versions | 2.4.22+git0.f8e3218e2-150400.3.22.1 |
haproxy SUSE:Linux Enterprise Micro 5.4 | All versions | 2.4.22+git0.f8e3218e2-150400.3.22.1 |
haproxy SUSE:Linux Enterprise Micro 5.5 | All versions | 2.4.22+git0.f8e3218e2-150400.3.22.1 |
haproxy openSUSE:Leap 15.6 | All versions | 2.8.11+git0.01c1056a4-150600.3.6.1 |
haproxy openSUSE:Tumbleweed | All versions | 3.2.0+git0.e134140d2-2.1 |
How do I fix CVE-2025-32464?
Upgrade haproxy to a fixed version for your release line: 2.9.6 or 3.1.7.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-32464 being exploited?
There is no known exploitation of CVE-2025-32464 in the wild and no public exploit code.
Sources
Also known as AZL-59712, BIT-haproxy-2025-32464, DEBIAN-CVE-2025-32464, DLA-4135-1, GHSA-frg5-h47x-75j9, MGASA-2025-0138 and 12 more.