CVE catalog

CVE-2023-45539

haproxy affected and fixed versions

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.

Severity: Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published: Nov 28, 2023, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.51% · Oct 27, 2026

Projects and upstream resources

[haproxy][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence

Original provider fields

{
  "package_releases": [
    {
      "name": "haproxy",
      "status": "fixed",
      "release": "sid",
      "version": "3.2.26-1"
    },
    {
      "name": "haproxy",
      "status": "fixed",
      "release": "forky",
      "version": "3.2.26-1"
    },
    {
      "name": "haproxy",
      "status": "fixed",
      "release": "trixie",
      "version": "3.0.11-1+deb13u3"
    },
    {
      "name": "haproxy",
      "status": "fixed",
      "release": "trixie-security",
      "version": "3.0.11-1+deb13u4"
    },
    {
      "name": "haproxy",
      "status": "fixed",
      "release": "bookworm",
      "version": "2.6.12-1+deb12u3"
    },
    {
      "name": "haproxy",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "2.6.12-1+deb12u4"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "haproxy",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "2.6.15-1"
    },
    {
      "bug": null,
      "name": "haproxy",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "2.6.15-1"
    },
    {
      "bug": null,
      "name": "haproxy",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "2.6.15-1"
    },
    {
      "bug": null,
      "name": "haproxy",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "2.6.12-1+deb12u1"
    }
  ],
  "distribution_packages": [
    {
      "name": "haproxy",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.8-1ubuntu0.13+esm2"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1.7.9-1ubuntu1",
        "1.7.9-1ubuntu2",
        "1.8.4-1",
        "1.8.7-1",
        "1.8.8-1",
        "1.8.8-1ubuntu0.1",
        "1.8.8-1ubuntu0.2",
        "1.8.8-1ubuntu0.3",
        "1.8.8-1ubuntu0.4",
        "1.8.8-1ubuntu0.6",
        "1.8.8-1ubuntu0.7",
        "1.8.8-1ubuntu0.8",
        "1.8.8-1ubuntu0.9",
        "1.8.8-1ubuntu0.10",
        "1.8.8-1ubuntu0.11",
        "1.8.8-1ubuntu0.13"
      ],
      "ecosystem": "deb",
      "fixed_version": "1.8.8-1ubuntu0.13+esm2",
      "provider_record_id": "USN-6530-2"
    },
    {
      "name": "haproxy",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.31-0ubuntu0.3"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "2.0.5-1",
        "2.0.8-1",
        "2.0.9-1",
        "2.0.10-1",
        "2.0.10-1ubuntu1",
        "2.0.11-1ubuntu1",
        "2.0.12-1ubuntu2",
        "2.0.13-1ubuntu2",
        "2.0.13-2",
        "2.0.13-2ubuntu0.1",
        "2.0.13-2ubuntu0.2",
        "2.0.13-2ubuntu0.3",
        "2.0.13-2ubuntu0.5",
        "2.0.29-0ubuntu1",
        "2.0.29-0ubuntu1.1",
        "2.0.29-0ubuntu1.3",
        "2.0.31-0ubuntu0.1",
        "2.0.31-0ubuntu0.2"
      ],
      "ecosystem": "deb",
      "fixed_version": "2.0.31-0ubuntu0.3",
      "provider_record_id": "USN-6530-1"
    },
    {
      "name": "haproxy",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.22-0ubuntu0.22.04.3"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "2.2.9-2ubuntu2",
        "2.4.8-1",
        "2.4.8-2ubuntu3",
        "2.4.11-1ubuntu1",
        "2.4.12-1ubuntu1",
        "2.4.12-1ubuntu2",
        "2.4.13-1ubuntu1",
        "2.4.14-1ubuntu1",
        "2.4.18-0ubuntu1",
        "2.4.18-0ubuntu1.1",
        "2.4.18-0ubuntu1.2",
        "2.4.18-0ubuntu1.3",
        "2.4.22-0ubuntu0.22.04.1",
        "2.4.22-0ubuntu0.22.04.2"
      ],
      "ecosystem": "deb",
      "fixed_version": "2.4.22-0ubuntu0.22.04.3",
      "provider_record_id": "USN-6530-1"
    },
    {
      "name": "haproxy",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.22+git0.f8e3218e2-150400.3.19.1"
            }
          ]
        }
      ],
      "release": "linux enterprise micro 5.3",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "2.4.22+git0.f8e3218e2-150400.3.19.1",
      "provider_record_id": "SUSE-SU-2023:4647-1"
    },
    {
      "name": "haproxy",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.22+git0.f8e3218e2-150400.3.19.1"
            }
          ]
        }
      ],
      "release": "linux enterprise micro 5.4",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "2.4.22+git0.f8e3218e2-150400.3.19.1",
      "provider_record_id": "SUSE-SU-2023:4647-1"
    },
    {
      "name": "haproxy",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.22+git0.f8e3218e2-150400.3.19.1"
            }
          ]
        }
      ],
      "release": "linux enterprise micro 5.5",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "2.4.22+git0.f8e3218e2-150400.3.19.1",
      "provider_record_id": "SUSE-SU-2023:4647-1"
    },
    {
      "name": "haproxy",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.22+git0.f8e3218e2-150400.3.19.1"
            }
          ]
        }
      ],
      "release": "linux enterprise high availability extension 15 sp4",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "2.4.22+git0.f8e3218e2-150400.3.19.1",
      "provider_record_id": "SUSE-SU-2023:4647-1"
    },
    {
      "name": "haproxy",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.22+git0.f8e3218e2-150400.3.19.1"
            }
          ]
        }
      ],
      "release": "linux enterprise high availability extension 15 sp5",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "2.4.22+git0.f8e3218e2-150400.3.19.1",
      "provider_record_id": "SUSE-SU-2023:4647-1"
    },
    {
      "name": "haproxy",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.22+git0.f8e3218e2-150400.3.19.1"
            }
          ]
        }
      ],
      "release": "leap micro 5.3",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "2.4.22+git0.f8e3218e2-150400.3.19.1",
      "provider_record_id": "SUSE-SU-2023:4647-1"
    },
    {
      "name": "haproxy",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.22+git0.f8e3218e2-150400.3.19.1"
            }
          ]
        }
      ],
      "release": "leap micro 5.4",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "2.4.22+git0.f8e3218e2-150400.3.19.1",
      "provider_record_id": "SUSE-SU-2023:4647-1"
    },
    {
      "name": "haproxy",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.22+git0.f8e3218e2-150400.3.19.1"
            }
          ]
        }
      ],
      "release": "leap 15.4",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "2.4.22+git0.f8e3218e2-150400.3.19.1",
      "provider_record_id": "SUSE-SU-2023:4647-1"
    },
    {
      "name": "haproxy",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.22+git0.f8e3218e2-150400.3.19.1"
            }
          ]
        }
      ],
      "release": "leap 15.5",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "2.4.22+git0.f8e3218e2-150400.3.19.1",
      "provider_record_id": "SUSE-SU-2023:4647-1"
    },
    {
      "name": "haproxy",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.31-150200.11.26.1"
            }
          ]
        }
      ],
      "release": "linux enterprise high availability extension 15 sp2",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "2.0.31-150200.11.26.1",
      "provider_record_id": "SUSE-SU-2023:4645-1"
    },
    {
      "name": "haproxy",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.31-150200.11.26.1"
            }
          ]
        }
      ],
      "release": "linux enterprise high availability extension 15 sp3",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "2.0.31-150200.11.26.1",
      "provider_record_id": "SUSE-SU-2023:4645-1"
    },
    {
      "name": "haproxy",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.8-1ubuntu0.13+esm2"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1.7.9-1ubuntu1",
        "1.7.9-1ubuntu2",
        "1.8.4-1",
        "1.8.7-1",
        "1.8.8-1",
        "1.8.8-1ubuntu0.1",
        "1.8.8-1ubuntu0.2",
        "1.8.8-1ubuntu0.3",
        "1.8.8-1ubuntu0.4",
        "1.8.8-1ubuntu0.6",
        "1.8.8-1ubuntu0.7",
        "1.8.8-1ubuntu0.8",
        "1.8.8-1ubuntu0.9",
        "1.8.8-1ubuntu0.10",
        "1.8.8-1ubuntu0.11",
        "1.8.8-1ubuntu0.13"
      ],
      "ecosystem": "deb",
      "fixed_version": "1.8.8-1ubuntu0.13+esm2",
      "provider_record_id": "UBUNTU-CVE-2023-45539"
    },
    {
      "name": "haproxy",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.31-0ubuntu0.3"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "2.0.5-1",
        "2.0.8-1",
        "2.0.9-1",
        "2.0.10-1",
        "2.0.10-1ubuntu1",
        "2.0.11-1ubuntu1",
        "2.0.12-1ubuntu2",
        "2.0.13-1ubuntu2",
        "2.0.13-2",
        "2.0.13-2ubuntu0.1",
        "2.0.13-2ubuntu0.2",
        "2.0.13-2ubuntu0.3",
        "2.0.13-2ubuntu0.5",
        "2.0.29-0ubuntu1",
        "2.0.29-0ubuntu1.1",
        "2.0.29-0ubuntu1.3",
        "2.0.31-0ubuntu0.1",
        "2.0.31-0ubuntu0.2"
      ],
      "ecosystem": "deb",
      "fixed_version": "2.0.31-0ubuntu0.3",
      "provider_record_id": "UBUNTU-CVE-2023-45539"
    },
    {
      "name": "haproxy",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.22-0ubuntu0.22.04.3"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "2.2.9-2ubuntu2",
        "2.4.8-1",
        "2.4.8-2ubuntu3",
        "2.4.11-1ubuntu1",
        "2.4.12-1ubuntu1",
        "2.4.12-1ubuntu2",
        "2.4.13-1ubuntu1",
        "2.4.14-1ubuntu1",
        "2.4.18-0ubuntu1",
        "2.4.18-0ubuntu1.1",
        "2.4.18-0ubuntu1.2",
        "2.4.18-0ubuntu1.3",
        "2.4.22-0ubuntu0.22.04.1",
        "2.4.22-0ubuntu0.22.04.2"
      ],
      "ecosystem": "deb",
      "fixed_version": "2.4.22-0ubuntu0.22.04.3",
      "provider_record_id": "UBUNTU-CVE-2023-45539"
    },
    {
      "name": "haproxy",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.22+git0.f8e3218e2-150400.3.19.1"
            }
          ]
        }
      ],
      "release": "linux enterprise micro 5.5",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "2.4.22+git0.f8e3218e2-150400.3.19.1",
      "provider_record_id": "SUSE-SU-2024:2377-1"
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[haproxy]Unknown
Details (4)
- 2.6.12-1+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 2.6.12-1+deb12u1
  dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12
- 2.6.12-1+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 2.6.12-1+deb12u1
  dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12
- 2.6.12-1+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 2.6.12-1+deb12u1
  dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12
- 2.6.12-1+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 2.6.12-1+deb12u1
  dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12
[haproxy-doc]Unknown
Source package: [haproxy]
Details (4)
- 2.6.12-1+deb12u3 · all · bookworm
  Fixed · Fixed: 2.6.12-1+deb12u1
  dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12
- 2.6.12-1+deb12u3 · all · bookworm
  Fixed · Fixed: 2.6.12-1+deb12u1
  dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12
- 2.6.12-1+deb12u3 · all · bookworm-security
  Fixed · Fixed: 2.6.12-1+deb12u1
  dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12
- 2.6.12-1+deb12u3 · all · bookworm-security
  Fixed · Fixed: 2.6.12-1+deb12u1
  dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12
[vim-haproxy]Unknown
Source package: [haproxy]
Details (4)
- 2.6.12-1+deb12u3 · all · bookworm
  Fixed · Fixed: 2.6.12-1+deb12u1
  dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12
- 2.6.12-1+deb12u3 · all · bookworm
  Fixed · Fixed: 2.6.12-1+deb12u1
  dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12
- 2.6.12-1+deb12u3 · all · bookworm-security
  Fixed · Fixed: 2.6.12-1+deb12u1
  dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12
- 2.6.12-1+deb12u3 · all · bookworm-security
  Fixed · Fixed: 2.6.12-1+deb12u1
  dsa · haproxy · debian · bookworm; dsa · haproxy · debian · 12

[Debian 13 (Trixie)]

[haproxy]Unknown
Details (5)
- 3.0.11-1+deb13u3 · amd64 · trixie
  Fixed · Fixed: 2.6.15-1
  dsa · haproxy · debian · 13
- 3.0.11-1+deb13u3 · arm64 · trixie
  Fixed · Fixed: 2.6.15-1
  dsa · haproxy · debian · 13
- 3.0.11-1+deb13u3 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 2.6.15-1
  dsa · haproxy · debian · 13
- 3.0.11-1+deb13u3 · arm64 · trixie-security
  Fixed · Fixed: 2.6.15-1
  dsa · haproxy · debian · 13
- 3.0.11-1+deb13u4 · amd64 · trixie-security
  Fixed · Fixed: 2.6.15-1
  dsa · haproxy · debian · 13
[haproxy-doc]Unknown
Source package: [haproxy]
Details (5)
- 3.0.11-1+deb13u3 · all · trixie
  Fixed · Fixed: 2.6.15-1
  dsa · haproxy · debian · 13
- 3.0.11-1+deb13u3 · all · trixie
  Fixed · Fixed: 2.6.15-1
  dsa · haproxy · debian · 13
- 3.0.11-1+deb13u3 · all · trixie-security
  Fixed · Fixed: 2.6.15-1
  dsa · haproxy · debian · 13
- 3.0.11-1+deb13u3 · all · trixie-security · Historical version
  Fixed · Fixed: 2.6.15-1
  dsa · haproxy · debian · 13
- 3.0.11-1+deb13u4 · all · trixie-security
  Fixed · Fixed: 2.6.15-1
  dsa · haproxy · debian · 13
[vim-haproxy]Unknown
Source package: [haproxy]
Details (5)
- 3.0.11-1+deb13u3 · all · trixie
  Fixed · Fixed: 2.6.15-1
  dsa · haproxy · debian · 13
- 3.0.11-1+deb13u3 · all · trixie
  Fixed · Fixed: 2.6.15-1
  dsa · haproxy · debian · 13
- 3.0.11-1+deb13u3 · all · trixie-security · Historical version
  Fixed · Fixed: 2.6.15-1
  dsa · haproxy · debian · 13
- 3.0.11-1+deb13u3 · all · trixie-security
  Fixed · Fixed: 2.6.15-1
  dsa · haproxy · debian · 13
- 3.0.11-1+deb13u4 · all · trixie-security
  Fixed · Fixed: 2.6.15-1
  dsa · haproxy · debian · 13

Observed: Oct 28, 2026, 5:43:10 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]