CVE-2013-1912

CVE-2013-1912 describes a buffer overflow vulnerability in HAProxy versions 1.4 through 1.4.22 and 1.5-dev through 1.5-dev17. This flaw occurs when HTTP keep-alive is enabled, HTTP keywords are used in TCP inspection rules, and rewrite rules append to requests. Remote attackers can exploit this by sending crafted pipelined HTTP requests, leading to a denial of service (crash) and potentially arbitrary code execution. The vulnerability has a CVSS score of 5.1 (medium severity), indicating a network-based attack with high attack complexity, requiring no authentication, and potentially impacting confidentiality, integrity, and availability. Its EPSS score is very low, suggesting a minimal likelihood of exploitation in the wild. There is no evidence of active exploitation, nor are there any public exploit modules available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are also extremely low, indicating a lack of widespread attention or concern.