Known vulnerabilities in haproxy (Debian package)

Vendor: Debian
Software CPE: cpe:2.3:o:debian:haproxy_debian_package:*:*:*:*:*:debian_linux:*:*
Total vulnerabilities: 15
Public exploits: 1
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting haproxy (Debian package) haproxy (Debian package) is affected by 15 known vulnerabilities: 1 high, 13 medium, 1 low Critical High Medium Low

Vulnerabilities (15)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU126147 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2026-33555
CWE-444 Medium
No
No
3.0.11-1+deb13u3 15.04.2026 SB2026041575
SB2026042424
SB2026042510
and 7 more
#VU122782 - Integer underflow
CVE-2026-26081
CWE-191 Medium
No
No
3.0.11-1+deb13u2 12.02.2026 SB2026021269
SB2026021273
SB2026021280
and 2 more
#VU116636 - Improper input validation
CVE-2025-11230
CWE-20 Medium
No
No
2.6.12-1+deb12u3, 3.0.11-1+deb13u1 06.10.2025 SB2025100656
SB2025100661
SB2025100663
and 19 more
#VU83902 - Improper input validation
CVE-2023-45539
CWE-20 Medium
No
No
2.2.9-2+deb11u6, 2.6.12-1+deb12u1 06.12.2023 SB2023082120
SB2023120617
SB2023120620
and 21 more
#VU79767 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2023-40225
CWE-444 Medium
No
No
2.2.9-2+deb11u6, 2.6.12-1+deb12u1 21.08.2023 SB2023082120
SB2023082121
SB2023082122
and 17 more
#VU74299 - Missing release of memory after effective lifetime
CVE-2023-0836
CWE-401 Low
No
No
2.2.9-2+deb11u5 03.04.2023 SB2023033109
SB2023040342
SB2023041402
and 7 more
#VU72334 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2023-25725
CWE-444 Medium
No
No
2.2.9-2+deb11u4 16.02.2023 SB2023021659
SB2023021662
SB2023021663
and 22 more
#VU71431 - Improper input validation
CVE-2023-0056
CWE-20 Medium
No
No
2.2.9-2+deb11u4 23.01.2023 SB2023012331
SB2023012332
SB2023012641
and 20 more
#VU61291 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2022-0711
CWE-835 Medium
No
No
2.2.9-2+deb11u3 14.03.2022 SB2022031420
SB2022031505
SB2022032910
and 8 more
#VU56401 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2021-40346
CWE-444 Medium
Available
No
2.2.9-2+deb11u2 08.09.2021 SB2021090813
SB2021090814
SB2021111101
and 11 more
#VU55971 - Improper input validation
CVE-2021-39242
CWE-20 Medium
No
No
2.2.9-2+deb11u1 18.08.2021 SB2021081816
SB2021081819
SB2021111101
and 4 more
#VU55970 - Improper input validation
CVE-2021-39241
CWE-20 Medium
No
No
2.2.9-2+deb11u1 18.08.2021 SB2021081816
SB2021081819
SB2021111101
and 7 more
#VU55969 - Improper input validation
CVE-2021-39240
CWE-20 Medium
No
No
2.2.9-2+deb11u1 18.08.2021 SB2021081816
SB2021081819
SB2021111101
and 4 more
#VU26549 - Heap-based Buffer Overflow
CVE-2020-11100
CWE-122 High
No
No
1.8.19-1+deb10u2 02.04.2020 SB2020040219
SB2020040220
SB2020040221
and 13 more
#VU23084 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2019-19330
CWE-93 Medium
No
No
1.8.19-1+deb10u1, 2.0.10-1 28.11.2019 SB2019112812
SB2019112813
SB2019120422
and 7 more