CVE-2024-45506

Name: CVE-2024-45506
Creator: NVD / NIST
Published: 2024-09-04T15:15:14.08+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.5/10EPSS 1.20%

Last modified Jun 17, 2026

CVE-2024-45506 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.. EPSS estimates a 1.20% chance of exploitation in the next 30 days.

Description

HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability

1.20%

64.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-835

Affected Software

Vendor	Product	Versions	Update
Haproxy	Haproxy	>= 2.9.0, < 2.9.10	—
Haproxy	Haproxy	>= 3.0.0, < 3.0.4	—
Haproxy	Haproxy	3.1	Dev0

References

http://git.haproxy.org/?p=haproxy-3.0.git%3Ba=commitdiff%3Bh=c725db17e8416ffb3c1537aea756356228ce5e3cBroken Link
http://git.haproxy.org/?p=haproxy-3.0.git%3Ba=commitdiff%3Bh=d636e515453320c6e122c313c661a8ac7d387c7fBroken Link
https://www.haproxy.org/Product
https://www.haproxy.org/download/3.1/src/CHANGELOGRelease Notes
https://www.mail-archive.com/haproxy%40formilux.org/msg45280.htmlRelease Notes
https://www.mail-archive.com/haproxy%40formilux.org/msg45281.htmlRelease Notes

Timeline

Published: Sep 4, 2024
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2024-45506?

How severe is CVE-2024-45506?

CVE-2024-45506 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 1.20% probability of exploitation in the next 30 days.

How do I fix CVE-2024-45506?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2024-45506?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST