haproxy haproxy

Name: haproxy haproxy
Brand: haproxy

productUS

cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

3critical18high11medium0low

updated 2026-10-27

vulnerabilities (36)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2021-40346US	high7.5	58.8% (99th)	Exploit	2.3.14	2021-09-08	5 versions
CVE-2023-25725US	critical9.1	5.45% (93rd)	Exploit	2.4.22	2023-02-14	6 versions
CVE-2023-25950US	high7.3	2.97% (87th)	Exploit	no fix	2023-04-11	2 versions
CVE-2023-45539US	high8.2OT elevated	1.51% (74th)	Exploit	2.8.2	2023-11-28	< 2.8.2
CVE-2026-33555US	medium5.8	0.31% (23rd)	Exploit	3.3.6	2026-04-13	2.6.0 → 3.3.6
CVE-2019-14241US	high7.5	70.2% (99th)	—	no fix	2019-07-23	2 versions
CVE-2020-11100US	high8.8	61.6% (99th)	—	2.1.4	2020-04-02	1.8.0 → 2.1.4
CVE-2016-5360US	high7.5	42.8% (99th)	—	no fix	2016-06-30	6 versions
CVE-2022-0711US	high7.5	16.6% (97th)	—	2.3.18	2022-03-02	3 versions
CVE-2019-18277US	high7.5	10.1% (96th)	—	2.0.6	2019-10-23	< 2.0.6
CVE-2018-10184US	high7.5	8.15% (95th)	—	1.8.8	2018-05-09	< 1.8.8
CVE-2018-20103US	high7.5	6.59% (94th)	—	no fix	2018-12-12	≤ 1.8.14
CVE-2013-1912US	medium5.1	5.57% (93rd)	—	no fix	2013-04-10	4 versions
CVE-2012-2942US	medium5.1	5.35% (93rd)	—	no fix	2012-05-27	≤ 1.4.20
CVE-2018-20615US	high7.5	4.46% (91st)	—	no fix	2019-03-21	2 versions
CVE-2015-3281US	medium5.0	4.33% (91st)	—	no fix	2015-07-06	16 versions
CVE-2018-20102US	high7.5	4.15% (91st)	—	no fix	2018-12-12	≤ 1.8.14
CVE-2019-19330US	critical9.8	4.03% (91st)	—	2.0.10	2019-11-27	< 2.0.10
CVE-2014-6269US	medium5.0	3.81% (90th)	—	no fix	2014-09-30	5 versions
CVE-2013-2175US	medium5.0	3.59% (89th)	—	no fix	2013-08-19	26 versions
CVE-2018-14645US	high7.5	3.07% (88th)	—	no fix	2018-09-21	≤ 1.8.14
CVE-2018-11469US	medium5.9	2.92% (87th)	—	no fix	2018-05-25	1.8.0 → 1.8.9
CVE-2016-2102US	medium5.3	2.29% (83rd)	—	no fix	2017-08-22	—
CVE-2021-39242US	high7.5	2.23% (83rd)	—	2.4.3	2021-08-17	3 versions
CVE-2021-39240US	high7.5	2.21% (83rd)	—	2.3.13	2021-08-17	3 versions
CVE-2023-40225US	high7.2	2.15% (82nd)	—	2.7.10	2023-08-10	6 versions
CVE-2023-0056US	medium6.5	1.83% (79th)	—	no fix	2023-03-23	—
CVE-2021-39241US	medium5.3	1.69% (77th)	—	2.3.13	2021-08-17	4 versions
CVE-2019-11323US	medium5.9OT elevated	1.25% (69th)	—	1.9.7	2019-05-09	1.9.2 → 1.9.7
CVE-2024-45506US	high7.5	1.20% (68th)	—	3.0.4	2024-09-04	3 versions
CVE-2023-0836US	high7.5	1.20% (68th)	—	2.2.27	2023-03-29	7 versions
CVE-2025-11230US	—	0.74% (54th)	—	3.1.9	2025-11-19	6 versions
CVE-2026-26080US	—	0.55% (46th)	—	3.2.12	2026-07-20	2 versions
CVE-2026-55204US	—	0.48% (41st)	—	2.6.30	2026-06-18	6 versions
CVE-2026-26081US	—	0.48% (41st)	—	3.1.14	2026-07-20	4 versions
CVE-2026-55203US	critical9.1	0.33% (27th)	—	2.4.36	2026-06-18	6 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer5 CVEs
CWE-20Improper Input Validation5 CVEs
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')5 CVEs
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')4 CVEs
CWE-125Out-of-bounds Read3 CVEs
CWE-400Uncontrolled Resource Consumption3 CVEs
CWE-130Improper Handling of Length Parameter Inconsistency2 CVEs
CWE-190Integer Overflow or Wraparound2 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE36 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan