VDB
ALPINE-CVE-2019-19330
ALPINE-CVE-2019-19330
PUBLISHED
CVSS 9.800000190734863 CRITICAL
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.8 | haproxy | 0, 1.3.17-r0, 1.3.20-r0 |
| Alpine:v3.9 | haproxy | 1.4.22-r3, 1.4.23-r0, 1.4.24-r0 |
Timeline
- Nov 27, 2019 CVE Published
- Nov 19, 2025 CVE Updated
- Apr 30, 2026 Distribution Patch