CVE-2024-45506
📋 TL;DR
HAProxy HTTP/2 zero-copy forwarding vulnerability allows remote attackers to cause denial of service by exploiting a loop condition in the h2_send function. This affects HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6. Organizations using vulnerable HAProxy versions with HTTP/2 enabled are at risk.
💻 Affected Systems
- HAProxy
📦 What is this software?
Haproxy by Haproxy
Haproxy by Haproxy
Haproxy by Haproxy
Haproxy by Haproxy
Haproxy by Haproxy
Haproxy by Haproxy
Haproxy by Haproxy
Haproxy by Haproxy
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage of HAProxy instances, disrupting all traffic through affected load balancers
Likely Case
Service degradation or crashes affecting HTTP/2 traffic specifically
If Mitigated
Minimal impact if HTTP/2 is disabled or patched versions are deployed
🎯 Exploit Status
Actively exploited in the wild as of 2024, though specific exploit details not publicly documented
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.9.10, 3.0.4, or later 3.1.x versions
Vendor Advisory: https://www.haproxy.org/
Restart Required: Yes
Instructions:
1. Download patched version from haproxy.org 2. Compile/install new version 3. Replace configuration files 4. Restart HAProxy service
🔧 Temporary Workarounds
Disable HTTP/2
allDisable HTTP/2 protocol support to prevent exploitation
Edit HAProxy config: remove 'alpn h2' from bind lines
Set 'proto h2' to 'proto h1'
Disable zero-copy forwarding
allDisable zero-copy forwarding feature for HTTP/2
Add 'no-zero-copy-forwarding' to global section or frontend bind lines
🧯 If You Can't Patch
- Implement rate limiting and connection limits to reduce attack surface
- Deploy HAProxy behind additional WAF or reverse proxy layer
🔍 How to Verify
Check if Vulnerable:
Check HAProxy version and verify HTTP/2 is enabled in configurationCheck Version:
haproxy -vVerify Fix Applied:
Verify running version is 2.9.10+, 3.0.4+, or patched 3.1.x version📡 Detection & Monitoring
Log Indicators:
- HAProxy process crashes
- High error rates for HTTP/2 connections
- Unusual restart patterns
Network Indicators:
- HTTP/2 connection floods
- Abnormal HTTP/2 frame sequences
SIEM Query:
source="haproxy.log" AND ("fatal" OR "emerg" OR "alert" OR "crit")🔗 References
- http://git.haproxy.org/?p=haproxy-3.0.git%3Ba=commitdiff%3Bh=c725db17e8416ffb3c1537aea756356228ce5e3c
- http://git.haproxy.org/?p=haproxy-3.0.git%3Ba=commitdiff%3Bh=d636e515453320c6e122c313c661a8ac7d387c7f
- https://www.haproxy.org/
- https://www.haproxy.org/download/3.1/src/CHANGELOG
- https://www.mail-archive.com/haproxy%40formilux.org/msg45280.html
- https://www.mail-archive.com/haproxy%40formilux.org/msg45281.html
