CVE-2019-19330 PUBLISHED

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.

EPSS 0.96% · 76.3th percentile

Risk Scores

EPSS Score
0.96%
76.3th percentile

Affected Products

VendorProductVersions
Ubuntu:18.04:LTShaproxy0, 1.7.9-1ubuntu1, 1.7.9-1ubuntu2

Timeline

References

Open in Interactive Console →