UpHeron
All vulnerabilities

Servers and applications

CVE-2018-20615

An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder in HAProxy 1.8.x and 1.9.x through 1.9.0 which can result in a crash. The processing of the PRIORITY flag in a HEADERS frame requires 5 extra bytes, and while these bytes are skipped, the total frame length was not re-checked to make sure they were present in the frame.

Severity
High 7.5
Published
21 Mar 2019
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
HAProxyServers and applications · cpe:a:haproxy:haproxy
  • Version 1.9.0
  • Version 1.9.0-dev11
  • Version 1.9.0-dev10
  • Version 1.9.0-dev9
All 14 release lines
  • From 1.8.0 up to 1.8.19
  • Version 1.9.0-dev0
  • Version 1.9.0-dev1
  • Version 1.9.0-dev2
  • Version 1.9.0-dev3
  • Version 1.9.0-dev4
  • Version 1.9.0-dev5
  • Version 1.9.0-dev6
  • Version 1.9.0-dev7
  • Version 1.9.0-dev8
  • Version 1.9.0-dev9
  • Version 1.9.0-dev10
  • Version 1.9.0-dev11
  • Version 1.9.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-20615
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-20615