CVE-2023-0056: An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• fedoraproject extra packages for enterprise linux8.0
• fedoraproject fedora36
• fedoraproject fedora37
• haproxy haproxyall versions
• redhat ceph storage5.0
• redhat openshift container platform4.10
• redhat openshift container platform4.11
• redhat openshift container platform4.12
• redhat openshift container platform for ibm linuxone4.10
• redhat openshift container platform for ibm linuxone4.11
• redhat openshift container platform for ibm linuxone4.12
• redhat openshift container platform for power4.10
• redhat openshift container platform for power4.11
• redhat openshift container platform for power4.12
• redhat openshift container platform ibm z systems4.10
• redhat openshift container platform ibm z systems4.11
• redhat openshift container platform ibm z systems4.12
• redhat software collectionsall versions

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• n/a haproxy

  • unknownaffected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2020-11100In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes
  53Plan
• CVE-2019-14241HAProxy through 2.0.2 allows attackers to cause a denial of service (ha_panic) via vectors related to htx_manage_client_side_cookies in prot
  51Plan
• CVE-2021-40346An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, a
  48Plan

Published before and after this one in the same product

• ← EarlierCVE-2022-0711Mar 2, 2022 · A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header.
  35Monitor
• ← EarlierCVE-2023-25725Feb 14, 2023 · HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smu
  38Monitor
• Later →CVE-2023-0836Mar 29, 2023 · An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.
  30Monitor

Root cause

Code that parses nested structures sets no depth or size limit. A small input can turn into a disproportionate processing load.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1function expand(node) {2  return node.children.map(expand);3}

1const MAX_DEPTH = 32;2function expand(node, depth = 0) {3  if (depth > MAX_DEPTH) throw new Error("too deep");4  return node.children.map((c) => expand(c, depth + 1));5}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.