Skip to content
Fencer Vulns
medium 6.5

CVE-2023-0056 json

An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service.

published 2023-03-23 3 y ago modified 2026-06-17 4 mo ago also BIT-haproxy-2023-0056 , EUVD-2023-12158

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 79%
public exploits
0
none known

Summary

An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability.

Patch / fix

  • haproxy haproxy 2.0.31, 2.2.27, 2.4.21, 2.5.11, 2.6.8, 2.7.2, 2.8-dev1
  • haproxy Debian 14, Debian 13, Debian 12 2.6.8-1

debian advisories DEBIAN-CVE-2023-0056

  • haproxy Ubuntu 20.04 LTS 2.0.29-0ubuntu1.1
  • haproxy Ubuntu 22.04 LTS 2.4.18-0ubuntu1.1

ubuntu advisories UBUNTU-CVE-2023-0056

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cri-o openshift 4.13 1.26.3-3.rhaos4.13.git641290e.el9
  • podman openshift 4.13 3:4.4.1-3.rhaos4.13.el8
  • podman openshift 4.13 3:4.4.1-3.rhaos4.13.el9
  • skopeo openshift 4.13 2:1.10.0-1.rhaos4.13.el9
  • buildah openshift 4.13 1:1.29.1-1.rhaos4.13.el9
  • haproxy openshift 4.13 2.2.24-3.rhaos4.13.el8
  • haproxy22 openshift 4.13 2.2.24-3.rhaos4.13.el8
  • openshift openshift 4.13 4.13.0-202304211155.p0.gb404935.assembly.stream.el8

red hat advisories RHSA-2023:1325RHSA-2023:0727RHSA-2023:1978RHSA-2023:1696RHBA-2023:1321RHBA-2023:0898

  • haproxy SLE High Availability Extension 15 SP3, SLE High Availability Extension 15 SP2 2.0.31-150200.11.20.1
  • haproxy SLE High Availability Extension 15 SP1 2.0.31-150100.8.31.1
  • haproxy SLE High Availability Extension 15 SP3, SLE High Availability Extension 15 SP2 2.0.14-150200.11.15.1
  • haproxy SLE High Availability Extension 15 SP1 2.0.14-150100.8.27.1
  • haproxy SLE Micro 5.3, SLE High Availability Extension 15 SP4, openSUSE Leap Micro 5.3 +1 more 2.4.8+git0.d1f8d41e0-150400.3.6.1

suse advisories SUSE-FU-2023:2119-1SUSE-FU-2023:2117-1SUSE-SU-2023:0413-1SUSE-SU-2023:0412-1SUSE-SU-2023:0153-1

  • haproxy AlmaLinux 9 2.4.17-3.el9_1.2

almalinux advisories ALSA-2023:1696

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-0056 updated cvss 4.3

haproxy: segfault DoS

  • Red Hat Enterprise Linux 7 haproxy Red Hat OpenShift Container Platform 3.11 haproxy, haproxy18
    affected: no fix planned “Out of support scope”
  • Red Hat Software Collections rh-haproxy18-haproxy, rh-haproxy18-haproxy-syspaths
    affected: no fix planned “Will not fix”
  • Red Hat Ceph Storage 5.3 Tools rhceph/rhceph-haproxy-rhel8 2.2.19-32
    fixed: vendor fix RHSA-2024:0746
  • Red Hat Enterprise Linux AppStream (v. 9) haproxy 2.4.17-3.el9_1.2
    fixed: vendor fix RHSA-2023:1696
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) haproxy 2.4.7-2.el9_0.2
    fixed: vendor fix RHSA-2023:1978
  • Red Hat OpenShift Container Platform 4.9 haproxy 2.2.15-6.el8, haproxy22 2.2.15-6.el8
    fixed: vendor fix RHBA-2023:1321
  • Red Hat OpenShift Container Platform 4.10 haproxy 2.2.19-3.el8, haproxy22 2.2.19-3.el8
    fixed: vendor fix RHBA-2023:0898
  • Red Hat OpenShift Container Platform 4.11 haproxy 2.2.24-2.el8, haproxy22 2.2.24-2.el8
    fixed: vendor fix RHBA-2023:0773
show 3 more
  • Red Hat OpenShift Container Platform 4.12 haproxy 2.2.24-2.el8, haproxy22 2.2.24-2.el8
    fixed: vendor fix RHSA-2023:0727
  • Red Hat OpenShift Container Platform 4.13 haproxy 2.2.24-3.rhaos4.13.el8, haproxy22 2.2.24-3.rhaos4.13.el8
    fixed: vendor fix RHSA-2023:1325
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.13 tox 3.23.0-2.el9.1, crudini 0.9.3-4.el9, pysnmp 4.4.12-6.el9, future 0.18.2-9.el9.1, subunit 1.4.0-6.el9.1, pyflakes 2.2.0-3.el9.1, +465 more Red Hat Ceph Storage 5.3 Tools rhceph/rhceph-5-rhel8 5-499, rhceph/keepalived-rhel8 2.1.5-39, rhceph/snmp-notifier-rhel8 1.2.1-50, rhceph/rhceph-5-dashboard-rhel8 5-83 Red Hat Enterprise Linux 8 haproxy Red Hat OpenShift Container Platform 4.9 afterburn 5.1.0-2.rhaos4.9.el8, rust-afterburn 5.1.0-2.rhaos4.9.el8, python-oslo-utils 4.8.1-0.20220307173146.4cc3a55.el8, python3-oslo-utils 4.8.1-0.20220307173146.4cc3a55.el8, python-oslo-utils-lang 4.8.1-0.20220307173146.4cc3a55.el8, python3-oslo-utils-tests 4.8.1-0.20220307173146.4cc3a55.el8, +4 more Red Hat OpenShift Container Platform 4.10 jenkins 2.361.4.1675935280-1.el8, jenkins-2-plugins 4.10.1675936179-1.el8 Red Hat OpenShift Container Platform 4.11 toolbox 0.1.1-1.rhaos4.11.el8, openshift 4.11.0-202302071554.p0.gdeccab3.assembly.stream.el8, openshift-hyperkube 4.11.0-202302071554.p0.gdeccab3.assembly.stream.el8
    +2 more products
    Red Hat OpenShift Container Platform 4.12 crun 1.4.2-2.rhaos4.12.el8, crun 1.4.2-3.rhaos4.12.el9, runc 1.1.4-2.rhaos4.12.el8, conmon 2.1.2-3.rhaos4.12.el8, conmon 2.1.2-4.rhaos4.12.el9, podman 4.2.0-5.rhaos4.12.el9, +38 more Red Hat OpenShift Container Platform 4.13 tini 0.16.1-1.el8ar, grpc 1.18.0-4.el8ost, python-rsa 4.7-1.el8, python3-rsa 4.7-1.el8, cri-tools 1.26.0-1.el9, grpc-cli 1.18.0-4.el8ost, +263 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
20 mo ago

Exploit prediction

1.83% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami haproxy — no fix listed

Affected products

  • n/a haproxy

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Add affected versions.