KEVIntel
Back to KEVs
7.5
CVSS
High

CVE-2024-45506

PUBLISHED

HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding...

Exploited in the wild Remote Low complexity No user interaction
Vendor
HAProxy
Product
HAProxy
Published
Sep 04, 2024
EPSS
—

Description

HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.

CVSS scores

CVSS v3.1 7.5 High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitation status

Exploited in the wild

Recorded 2024-09-04 00:00:00 UTC · Source

SSVC decision points

Exploitation
none
Automatable
Yes
Technical impact
partial

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source Added
CVE Sep 04, 2024

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel