What’s Vulnerable › Vulnerabilities

CVE-2022-0711

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 16.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-02 · updated 2026-06-17
• Weakness: CWE-835

Description

A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.

Affected products

• Debian Linux: 11.0
• HAProxy: from 2.2.0 before 2.2.21; from 2.3.0 before 2.3.18; from 2.4.0 before 2.4.13 — fixed in 2.2.21, 2.3.18, 2.4.13
• Red Hat Enterprise Linux: 7.0, 8.0
• Red Hat OpenShift Container Platform 4.18: 4.0
• RedHat Software Collections: all versions

How to fix

Upgrade to a fixed version: HAProxy 2.2.21, 2.3.18, 2.4.13. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/security/cve/cve-2022-0711
• https://github.com/haproxy/haproxy/commit/bfb15ab34ead85f64cd6da0e9fb418c9cd14cee8
• https://www.debian.org/security/2022/dsa-5102
• https://www.mail-archive.com/haproxy%40formilux.org/msg41833.html
• https://access.redhat.com/security/cve/cve-2022-0711
• https://github.com/haproxy/haproxy/commit/bfb15ab34ead85f64cd6da0e9fb418c9cd14cee8
• https://www.debian.org/security/2022/dsa-5102
• https://www.mail-archive.com/haproxy%40formilux.org/msg41833.html

Get alerted when CVE-2022-0711 or the next vulnerability affects your stack