VYPR
← All advisories
High severity7.5OSV Advisory· Published Mar 21, 2019· Updated Jun 17, 2026

CVE-2018-20615

CVE-2018-20615

Description

An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder in HAProxy 1.8.x and 1.9.x through 1.9.0 which can result in a crash. The processing of the PRIORITY flag in a HEADERS frame requires 5 extra bytes, and while these bytes are skipped, the total frame length was not re-checked to make sure they were present in the frame.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

27
  • Haproxy/HaproxyOSV16 versions
    v1.0.0, v1.0.1, v1.0.2, …+ 15 more
    • (no CPE)range: v1.0.0, v1.0.1, v1.0.2, …
    • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*range: >=1.8.0,<=1.8.19
    • cpe:2.3:a:haproxy:haproxy:1.9.0:-:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy:1.9.0:dev0:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy:1.9.0:dev10:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy:1.9.0:dev11:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy:1.9.0:dev1:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy:1.9.0:dev2:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy:1.9.0:dev3:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy:1.9.0:dev4:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy:1.9.0:dev5:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy:1.9.0:dev6:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy:1.9.0:dev7:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy:1.9.0:dev8:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy:1.9.0:dev9:*:*:*:*:*:*
    • (no CPE)range: 1.8.x and 1.9.x through 1.9.0
  • Red Hat/Openshift Container Platform
    cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*
  • Canonical/Ubuntu Linux3 versions
    cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*+ 2 more
    • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
  • OpenSUSE/Leap
    cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
  • Red Hat/Enterprise Linux Server4 versions
    cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:*
  • osv-coords2 versions
    pkg:rpm/opensuse/haproxy&distro=openSUSE%20Tumbleweedpkg:rpm/suse/haproxy&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015
    < 2.4.4+git0.acb1d0bea-1.2+ 1 more
    • (no CPE)range: < 2.4.4+git0.acb1d0bea-1.2
    • (no CPE)range: < 1.8.17~git0.e89d25b2-3.9.1

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.