Read the docs
TI-2022-00625 Aliases CVE-2022-0711GHSA-x4fc-x944-v9p7

Infinite loop in haproxy

Priority MEDIUM 50CWE-835Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-835.

Summary

A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.

Why it matters now

EPSS 0.16563 97th percentileScored 2026-11-07
Fix Fixed Red Hat: 4 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—haproxy2.5.1—No fix listedCNA
  • haproxy Vendor— Affected 2.5.1 Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*2.2.0 to before 2.2.21; 2.3.0 to before 2.3.18; 2.4.0 to before 2.4.13VulnerableHAProxy
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* Versions 2.2.0 to before 2.2.21; 2.3.0 to before 2.3.18; 2.4.0 to before 2.4.13 Vulnerable ·HAProxy
  • cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

Red Hat 4 advisories

  • RHSA-2022:1620 Released 2022-05-04 · Red Hat rating Important
    OpenShift Container Platform 4.6.57 packages and security update
    • Red Hat OpenShift Container Platform 4.6 haproxy-2.0.16-3.el7, haproxy-2.0.16-5.el8, haproxy20-2.0.16-3.el7 +2
  • RHSA-2022:1336 Released 2022-04-20 · Red Hat rating Important
    OpenShift Container Platform 4.7.49 security update
    • Red Hat OpenShift Container Platform 4.7 haproxy-2.0.19-3.el7, haproxy-2.0.19-3.el8, haproxy20-2.0.19-3.el7 +1
  • RHSA-2022:1153 Released 2022-04-11 · Red Hat rating Important
    OpenShift Container Platform 4.8.36 security update
    • Red Hat OpenShift Container Platform 4.8 haproxy-2.2.13-3.el8, haproxy22-2.2.13-3.el8
Show 1 more Red Hat advisories
  • RHSA-2022:1021 Released 2022-03-29 · Red Hat rating Important
    OpenShift Container Platform 4.9.26 security update
    • Red Hat OpenShift Container Platform 4.9 haproxy-2.2.15-4.el8, haproxy22-2.2.15-4.el8, jenkins-2-plugins-4.9.1647580879-1.el8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 4.6Fixed RHSA-2022:1620
Red Hat OpenShift Container Platform 4.7Fixed RHSA-2022:1336
Red Hat OpenShift Container Platform 4.8Fixed RHSA-2022:1153
Red Hat OpenShift Container Platform 4.9Fixed RHSA-2022:1021
Not affected: 9 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4.6
  • Red Hat OpenShift Container Platform 4.8
  • Red Hat OpenShift Container Platform 4.9
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-0711
  2. 2026-10-03 Alias added: GHSA-x4fc-x944-v9p7

References

Patch 1

Advisory 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences