HTTP/2 Header Mismanagement in HAProxy by HAProxy Technologies
CVE-2019-19330

9.8CRITICAL

Key Information:

Vendor: Haproxy
Status: Haproxy
Vendor: CVE Published:; 27 November 2019

What is CVE-2019-19330?

HAProxy prior to version 2.0.10 features a flaw in its HTTP/2 implementation that mishandles certain headers, allowing for intermediary encapsulation attacks. The vulnerability arises from the improper processing of carriage return (CR), line feed (LF), and null (NUL) characters, which could potentially lead to various security impacts. System administrators are advised to upgrade to the latest versions to mitigate risks associated with this issue.