← Vulnerability feed

Vulnerability record · CVE-2013-1912 · published 10 April 2013

CVE-2013-1912: Haproxy memory buffer overflow vulnerability

Haproxy · Haproxy

Buffer overflow in HAProxy 1.4 through 1.4.22 and 1.5-dev through 1.5-dev17, when HTTP keep-alive is enabled, using HTTP keywords in TCP inspection rules, and running with rewrite rules that appends to requests, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted pipelined HTTP requests that prevent request realignment from occurring.

5.1 CVSS 2.0 Medium EPSS 5.5% · top 7.5% CWE-119 · Memory buffer overflow
5.1CVSS 2.0 base score
5.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
20References
16 Jun 2026Last modified by NVD

Description

Buffer overflow in HAProxy 1.4 through 1.4.22 and 1.5-dev through 1.5-dev17, when HTTP keep-alive is enabled, using HTTP keywords in TCP inspection rules, and running with rewrite rules that appends to requests, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted pipelined HTTP requests that prevent request realignment from occurring.

AV:N/AC:H/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103730.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103770.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103794.html
http://rhn.redhat.com/errata/RHSA-2013-0729.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0868.html
http://secunia.com/advisories/52725 Vendor Advisory
http://www.debian.org/security/2013/dsa-2711
http://www.openwall.com/lists/oss-security/2013/04/03/1
http://www.securityfocus.com/bid/58820
http://www.ubuntu.com/usn/USN-1800-1
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103730.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103770.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103794.html
http://rhn.redhat.com/errata/RHSA-2013-0729.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0868.html
http://secunia.com/advisories/52725 Vendor Advisory
http://www.debian.org/security/2013/dsa-2711
http://www.openwall.com/lists/oss-security/2013/04/03/1
http://www.securityfocus.com/bid/58820
http://www.ubuntu.com/usn/USN-1800-1

Track CVE-2013-1912 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-19330Haproxy injection vulnerabilityThe HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa),…EPSS 4.0%9.1CVE-2023-25725Haproxy http request smuggling vulnerabilityHAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." …EPSS 5.4%9.0CVE-2026-55203Haproxy integer overflow vulnerabilityHAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer …EPSS 0.58%8.8CVE-2020-11100HAProxy HPACK decoder heap out-of-bounds writeThe HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4 contains an out-of-bounds write in hpack_dht_insert in hpack-tbl.c. A crafted HTTP/2 reques…EPSS 61%analysed8.7CVE-2026-55204Haproxy null pointer dereference vulnerabilityHAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that f…EPSS 0.48%8.2CVE-2023-45539Haproxy vulnerabilityHAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified o…EPSS 1.5%7.5CVE-2025-11230Haproxy aloha appliance vulnerabilityInefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.EPSS 0.69%7.5CVE-2024-45506Haproxy vulnerabilityHAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_sen…EPSS 1.2%

Source: NIST National Vulnerability Database (record CVE-2013-1912), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.