Uncontrolled resource consumption in haproxy
Priority LOW 33CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 8 fixed, 3 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-400.
Summary
An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01834 79th percentileScored 2026-11-07
Fix Partial Red Hat: 5 advisoriesRed Hat: 8 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | haproxy | unknown | — | No fix listed | CNA |
- haproxy Vendor— Affected unknown Fixed in — No fix listed CNA
CPE configurations NVD · 23
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:haproxy:haproxy:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | HAProxy |
| cpe:2.3:a:redhat:ceph_storage:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:* | 4.12 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_for_ibm_linuxone:4.12:*:*:*:*:*:*:* | 4.12 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_for_power:4.12:*:*:*:*:*:*:* | 4.12 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.12:*:*:*:*:*:*:* | 4.12 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Running on | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:arm64:* | 4.10 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:arm64:* | 4.11 | Vulnerable | Red Hat |
- cpe:2.3:a:haproxy:haproxy:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·HAProxy
- cpe:2.3:a:redhat:ceph_storage:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:* Versions 4.12 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_for_ibm_linuxone:4.12:*:*:*:*:*:*:* Versions 4.12 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_for_power:4.12:*:*:*:*:*:*:* Versions 4.12 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.12:*:*:*:*:*:*:* Versions 4.12 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Running on ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:arm64:* Versions 4.10 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:arm64:* Versions 4.11 Vulnerable ·Red Hat
Show 13 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:arm64:* | 4.12 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:* | 4.10 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_for_ibm_linuxone:4.10:*:*:*:*:*:*:* | 4.10 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:* | 4.10 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.10:*:*:*:*:*:*:* | 4.10 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Running on | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:* | 4.11 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_for_ibm_linuxone:4.11:*:*:*:*:*:*:* | 4.11 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_for_power:4.11:*:*:*:*:*:*:* | 4.11 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.11:*:*:*:*:*:*:* | 4.11 | Vulnerable | Red Hat |
| cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
- cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:arm64:* Versions 4.12 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_for_ibm_linuxone:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:* Versions 4.11 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_for_ibm_linuxone:4.11:*:*:*:*:*:*:* Versions 4.11 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_for_power:4.11:*:*:*:*:*:*:* Versions 4.11 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.11:*:*:*:*:*:*:* Versions 4.11 Vulnerable ·Red Hat
- cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
Remediation
Red Hat 5 advisories
- RHSA-2024:0746 Released 2024-02-08 · Red Hat rating Importantnew container image: rhceph-5.3
- Red Hat Ceph Storage 5.3 Tools rhceph/rhceph-5-dashboard-rhel8, rhceph/rhceph-haproxy-rhel8
- RHSA-2023:1325 Released 2023-05-18 · Red Hat rating ImportantOpenShift Container Platform 4.13.0 security update
- Ironic content for Red Hat OpenShift Container Platform 4.13 python-werkzeug-2.0.3-4.el9, python3-werkzeug-2.0.3-4.el9
- Red Hat OpenShift Container Platform 4.13 buildah-1:1.29.1-1.rhaos4.13.el9, buildah-tests-1:1.29.1-1.rhaos4.13.el9, cri-o-1.26.3-3.rhaos4.13.git641290e.el9 +27
- RHSA-2023:1978 Released 2023-04-25 · Red Hat rating Moderatehaproxy security update
- Red Hat Enterprise Linux AppStream EUS (v.9.0) haproxy-2.4.7-2.el9_0.2
Show 2 more Red Hat advisories
- RHSA-2023:1696 Released 2023-04-11 · Red Hat rating Moderatehaproxy security update
- Red Hat Enterprise Linux AppStream (v. 9) haproxy-2.4.17-3.el9_1.2
- RHSA-2023:0727 Released 2023-02-16 · Red Hat rating ModerateOpenShift Container Platform 4.12.3 security update
- Red Hat OpenShift Container Platform 4.12 buildah-1:1.23.4-4.rhaos4.12.el8, buildah-1:1.23.4-4.rhaos4.12.el9, buildah-tests-1:1.23.4-4.rhaos4.12.el8 +45
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 5.3 Tools | Fixed | RHSA-2024:0746 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:1696 |
| Red Hat Enterprise Linux AppStream EUS (v.9.0) | Fixed | RHSA-2023:1978 |
| Red Hat OpenShift Container Platform 4.10 | Fixed | — |
| Red Hat OpenShift Container Platform 4.11 | Fixed | — |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2023:0727 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2023:1325 |
| Red Hat OpenShift Container Platform 4.9 | Fixed | — |
Not affected: 8 products
- Ironic content for Red Hat OpenShift Container Platform 4.13
- Red Hat Ceph Storage 5.3 Tools
- Red Hat Enterprise Linux 8
- Red Hat OpenShift Container Platform 4.10
- Red Hat OpenShift Container Platform 4.11
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.9
Timeline
- 2026-10-02 Threatist record created from CVE-2023-0056
- 2026-10-03 Alias added: GHSA-43q4-pf55-3xhc
References
Sources
- CVE-2023-0056 · CVE Program
- CVE-2023-0056 · NVD
- FIRST EPSS
- GHSA-43q4-pf55-3xhc · GitHub Advisory Database · CC BY 4.0
- CVE-2023-0056 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences