Back to Database
Status published
Critical
CVE-2019-19330
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as...
Vulnerability Description
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-19330
Credits & Attribution
No credits recorded in the NVD database.
References
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=54f53ef7ce4102be596130b44c768d1818570344
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=146f53ae7e97dbfe496d0445c2802dd0a30b0878
- https://git.haproxy.org/?p=haproxy-2.0.git%3Ba=commit%3Bh=ac198b92d461515551b95daae20954b3053ce87e
- https://tools.ietf.org/html/rfc7540#section-10.3
- https://www.debian.org/security/2019/dsa-4577
- https://seclists.org/bugtraq/2019/Nov/45
- https://usn.ubuntu.com/4212-1/
- https://security.gentoo.org/glsa/202004-01
More from haproxy
View All →CVE-2021-40346
An integer overflow exists in HAProxy 2.0 through 2.5 in...
High
7.5
CVE-2021-39242
An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3...
High
7.5
CVE-2021-39241
An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2...
Medium
5.3
CVE-2021-39240
An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3...
High
7.5
CVE-2020-11100
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy...
High
8.8
Affected Vendor
haproxy
View all reports →Affected Software
haproxy, ubuntu linux, debian linux
Vulnerable Versions:
0, 18.04, 19.04, 19.10, 10.0
Timeline
Official Publish:
November 27th, 2019
Last Modified:
August 5th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.