CVE catalog
CVE-2018-10184
haproxy: CVE-2018-10184
- Severity
- High · CVSS 8.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 8.15% · Oct 25, 2026
An issue was discovered in HAProxy before 1.8.8. The incoming H2 frame length was checked against the max_frame_size setting instead of being checked against the bufsize. The max_frame_size only applies to outgoing traffic and not to incoming, so if a large enough frame size is advertised in the SETTINGS frame, a wrapped frame will be defragmented into a temporary allocated buffer where the second fragment may overflow the heap by up to 16 kB. It is very unlikely that this can be exploited for code execution given that buffers are very short lived and their addresses not realistically predictable in production, but the likelihood of an immediate crash is absolutely certain.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | haproxy | sid | 3.2.26-1 | fixed |
| Debian | haproxy | forky | 3.2.26-1 | fixed |
| Debian | haproxy | trixie | 3.0.11-1+deb13u3 | fixed |
| Debian | haproxy | trixie-security | 3.0.11-1+deb13u4 | fixed |
| Debian | haproxy | bookworm | 2.6.12-1+deb12u3 | fixed |
| Debian | haproxy | bookworm-security | 2.6.12-1+deb12u4 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | haproxy | source | sid | 1.8.8-1 | not yet assigned | Not reported | Not reported |
| Debian | haproxy | source | forky | 1.8.8-1 | not yet assigned | Not reported | Not reported |
| Debian | haproxy | source | trixie | 1.8.8-1 | not yet assigned | Not reported | Not reported |
| Debian | haproxy | source | bookworm | 1.8.8-1 | not yet assigned | Not reported | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [haproxy]Unknown
Details (4)
2.6.12-1+deb12u3· amd64 · bookwormFixed · Fixed:
1.8.8-1dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12
2.6.12-1+deb12u3· arm64 · bookwormFixed · Fixed:
1.8.8-1dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12
2.6.12-1+deb12u3· amd64 · bookworm-securityFixed · Fixed:
1.8.8-1dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12
2.6.12-1+deb12u3· arm64 · bookworm-securityFixed · Fixed:
1.8.8-1dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12
- [haproxy-doc]Unknown
Source package: [haproxy]
Details (4)
2.6.12-1+deb12u3· all · bookwormFixed · Fixed:
1.8.8-1dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12
2.6.12-1+deb12u3· all · bookwormFixed · Fixed:
1.8.8-1dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12
2.6.12-1+deb12u3· all · bookworm-securityFixed · Fixed:
1.8.8-1dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12
2.6.12-1+deb12u3· all · bookworm-securityFixed · Fixed:
1.8.8-1dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12
- [vim-haproxy]Unknown
Source package: [haproxy]
Details (4)
2.6.12-1+deb12u3· all · bookwormFixed · Fixed:
1.8.8-1dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12
2.6.12-1+deb12u3· all · bookwormFixed · Fixed:
1.8.8-1dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12
2.6.12-1+deb12u3· all · bookworm-securityFixed · Fixed:
1.8.8-1dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12
2.6.12-1+deb12u3· all · bookworm-securityFixed · Fixed:
1.8.8-1dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12
[Debian 13 (Trixie)]
- [haproxy]Unknown
Details (5)
3.0.11-1+deb13u3· amd64 · trixieFixed · Fixed:
1.8.8-1dsa · haproxy · debian · 13
3.0.11-1+deb13u3· arm64 · trixieFixed · Fixed:
1.8.8-1dsa · haproxy · debian · 13
3.0.11-1+deb13u3· amd64 · trixie-security · Historical versionFixed · Fixed:
1.8.8-1dsa · haproxy · debian · 13
3.0.11-1+deb13u3· arm64 · trixie-securityFixed · Fixed:
1.8.8-1dsa · haproxy · debian · 13
3.0.11-1+deb13u4· amd64 · trixie-securityFixed · Fixed:
1.8.8-1dsa · haproxy · debian · 13
- [haproxy-doc]Unknown
Source package: [haproxy]
Details (5)
3.0.11-1+deb13u3· all · trixieFixed · Fixed:
1.8.8-1dsa · haproxy · debian · 13
3.0.11-1+deb13u3· all · trixieFixed · Fixed:
1.8.8-1dsa · haproxy · debian · 13
3.0.11-1+deb13u3· all · trixie-securityFixed · Fixed:
1.8.8-1dsa · haproxy · debian · 13
3.0.11-1+deb13u3· all · trixie-security · Historical versionFixed · Fixed:
1.8.8-1dsa · haproxy · debian · 13
3.0.11-1+deb13u4· all · trixie-securityFixed · Fixed:
1.8.8-1dsa · haproxy · debian · 13
- [vim-haproxy]Unknown
Source package: [haproxy]
Details (5)
3.0.11-1+deb13u3· all · trixieFixed · Fixed:
1.8.8-1dsa · haproxy · debian · 13
3.0.11-1+deb13u3· all · trixieFixed · Fixed:
1.8.8-1dsa · haproxy · debian · 13
3.0.11-1+deb13u3· all · trixie-security · Historical versionFixed · Fixed:
1.8.8-1dsa · haproxy · debian · 13
3.0.11-1+deb13u3· all · trixie-securityFixed · Fixed:
1.8.8-1dsa · haproxy · debian · 13
3.0.11-1+deb13u4· all · trixie-securityFixed · Fixed:
1.8.8-1dsa · haproxy · debian · 13
Observed:
References
- [https://osv.dev/vulnerability/DEBIAN-CVE-2018-10184]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2018-10184]
- [https://security-tracker.debian.org/tracker/CVE-2018-10184]
- [https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-10184.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]