CVE-2024-49214

mediumpriority · track · 0EPSS 0.005 · 44 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.52% (44th) EPSS

CVSS 5.3 · medium

Is it mine?

12 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.3mediumAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.15.3mediumCVSS:3.1/AC:L/AV:N/A:N/C:N/I:L/PR:N/S:U/UI:Nsecondary · ENISA EU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · cve@mitre.org USexploitability 3.9 · impact 1.4

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-290USCWE-290US

affected products (12)

Products and version ranges known to be affected.

HAProxy Enterprise <2.9.11all versionscert_bundDE
HAProxy Enterprise <3.0.5all versionscert_bundDE
SUSE openSUSEall versionscert_bundDEcpe:/o:suse:opensuse:-
HAProxy haproxy< 2.9.11cert_bundDE
HAProxy haproxy< 3.0.5cert_bundDE
n/a n/a≤ n/aenisa_euvdEU
Willy Terreau HAProxy2.9 → 2.9.11fstec_bduRU
Willy Terreau HAProxy3.0 → 3.0.5fstec_bduRU
Willy Terreau HAProxy3.1 → 3.1-dev7fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
Bitnami haproxy< 2.9.11osvUSpkg:bitnami/haproxy
Bitnami haproxy3.0.0 → 3.0.5osvUSpkg:bitnami/haproxy

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-3157HAProxy Enterprise: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2024-10-13csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in HAProxy Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
BIT-haproxy-2024-492142024-10-22vendor · osvUS
QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund osv NVD CVE.org MITRE

published 2024-10-14modified 2026-06-17

references (24)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan