Medium severity5.3NVD Advisory· Published Oct 14, 2024· Updated Apr 15, 2026
CVE-2024-49214
CVE-2024-49214
Description
QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.
Patches
4a2aea9f57362db1a7513b7882fb1776f5c77f627b9272bd8Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
7- github.com/haproxy/haproxy/commit/f627b9272bd8ffca6f2f898bfafc6bf0b84b7d46nvd
- www.haproxy.org/download/2.9/src/CHANGELOGnvd
- www.haproxy.org/download/3.0/src/CHANGELOGnvd
- www.haproxy.org/download/3.1/src/CHANGELOGnvd
- www.mail-archive.com/haproxy%40formilux.org/msg45291.htmlnvd
- www.mail-archive.com/haproxy%40formilux.org/msg45314.htmlnvd
- www.mail-archive.com/haproxy%40formilux.org/msg45315.htmlnvd
News mentions
0No linked articles in our index yet.