CVE-2013-2175

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-08-19 · updated 2026-06-16
Weakness: CWE-20

Description

HAProxy 1.4 before 1.4.24 and 1.5 before 1.5-dev19, when configured to use hdr_ip or other "hdr_*" functions with a negative occurrence count, allows remote attackers to cause a denial of service (negative array index usage and crash) via an HTTP header with a certain number of values, related to the MAX_HDR_HISTORY variable.

Affected products

Canonical Ubuntu Linux: 12.04, 12.10, 13.04
Debian Linux: 6.0
HAProxy: 1.4, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.4.4 (+39)
RedHat Enterprise Linux Load Balancer: 6.0, 6.4

References

http://marc.info/?l=haproxy&m=137147915029705&w=2
http://rhn.redhat.com/errata/RHSA-2013-1120.html
http://rhn.redhat.com/errata/RHSA-2013-1204.html
http://secunia.com/advisories/54344
http://www.debian.org/security/2013/dsa-2711
http://www.ubuntu.com/usn/USN-1889-1
https://bugzilla.redhat.com/show_bug.cgi?id=974259
http://marc.info/?l=haproxy&m=137147915029705&w=2
http://rhn.redhat.com/errata/RHSA-2013-1120.html
http://rhn.redhat.com/errata/RHSA-2013-1204.html
http://secunia.com/advisories/54344
http://www.debian.org/security/2013/dsa-2711

Get alerted when CVE-2013-2175 or the next vulnerability affects your stack