CVE-2019-11323

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-05-09 · updated 2026-06-17
Weakness: CWE-327

Description

HAProxy before 1.9.7 mishandles a reload with rotated keys, which triggers use of uninitialized, and very predictable, HMAC keys. This is related to an include/types/ssl_sock.h error.

Affected products

HAProxy: from 1.9.2 before 1.9.7 — fixed in 1.9.7

How to fix

Upgrade to a fixed version: HAProxy 1.9.7. Check the vendor advisory for mitigations.

References

http://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=8ef706502aa2000531d36e4ac56dbdc7c30f718d
https://www.mail-archive.com/haproxy%40formilux.org/msg33410.html
http://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=8ef706502aa2000531d36e4ac56dbdc7c30f718d
https://www.mail-archive.com/haproxy%40formilux.org/msg33410.html

Get alerted when CVE-2019-11323 or the next vulnerability affects your stack