CVE-2018-20615

25

FAUCET Score

CVE-2018-20615 is an out-of-bounds read vulnerability in the HTTP/2 protocol decoder of HAProxy versions 1.8.x and 1.9.x through 1.9.0, affecting products from vendors like Canonical, openSUSE, and Red Hat. This flaw, rated 7.5 HIGH, allows an unauthenticated attacker to cause a denial of service (crash) by sending a specially crafted HEADERS frame with the PRIORITY flag. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 1.8.0, <= 1.8.19CPE matchmatch criteria	cpe:2.3:a:haproxy:haproxy::::::::
		1.9.0CPE matchmatch criteria	cpe:2.3:a:haproxy:haproxy:1.9.0:-::::::
		1.9.0CPE matchmatch criteria	cpe:2.3:a:haproxy:haproxy:1.9.0:dev0::::::
		1.9.0CPE matchmatch criteria	cpe:2.3:a:haproxy:haproxy:1.9.0:dev1::::::
		1.9.0CPE matchmatch criteria	cpe:2.3:a:haproxy:haproxy:1.9.0:dev10::::::

CVSS Data

CVSS version used by this source: 3.0

7.5HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

3.6

CvssVersion

3.0

Exploit Intelligence

EPSS Score

4.46%

Probability of exploitation in next 30 days

EPSS Percentile

90.4%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0446 is in the 83rd percentile among its peer group of 51,551 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (25)

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 3.10Fixed in: haproxy-0:1.8.17-3.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 3.11Fixed in: atomic-enterprise-service-catalog-1:3.11.82-1.git.1673.133961e.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 3.11Fixed in: atomic-openshift-0:3.11.82-1.git.0.08bc31b.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 3.11Fixed in: atomic-openshift-cluster-autoscaler-0:3.11.82-1.git.0.efb6af0.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 3.11Fixed in: atomic-openshift-descheduler-0:3.11.82-1.git.300.89765c9.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 3.11Fixed in: atomic-openshift-dockerregistry-0:3.11.82-1.git.452.0ce6383.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 3.11Fixed in: atomic-openshift-metrics-server-0:3.11.82-1.git.52.2fdca3f.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 3.11Fixed in: atomic-openshift-node-problem-detector-0:3.11.82-1.git.254.a448936.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 3.11Fixed in: atomic-openshift-service-idler-0:3.11.82-1.git.14.e353758.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 3.11Fixed in: atomic-openshift-web-console-0:3.11.82-1.git.355.5e8b1d9.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 3.11Fixed in: golang-github-openshift-oauth-proxy-0:3.11.82-1.git.425.7cac034.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 3.11Fixed in: golang-github-prometheus-alertmanager-0:3.11.82-1.git.0.3bf41ce.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 3.11Fixed in: golang-github-prometheus-node_exporter-0:3.11.82-1.git.1063.48444e8.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 3.11Fixed in: golang-github-prometheus-prometheus-0:3.11.82-1.git.5027.9d24833.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 3.11Fixed in: haproxy-0:1.8.17-3.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 3.11Fixed in: jenkins-0:2.150.2.1549032159-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 3.11Fixed in: jenkins-2-plugins-0:3.11.1549642489-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 3.11Fixed in: openshift-ansible-0:3.11.82-3.git.0.9718d0a.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 3.11Fixed in: openshift-enterprise-autoheal-0:3.11.82-1.git.219.0b5aff4.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 3.11Fixed in: openshift-enterprise-cluster-capacity-0:3.11.82-1.git.380.cf11c51.el7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 3.9Fixed in: haproxy-0:1.8.17-3.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-haproxy18-haproxy-0:1.8.4-4.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: rh-haproxy18-haproxy-0:1.8.4-4.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: rh-haproxy18-haproxy-0:1.8.4-4.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-haproxy18-haproxy-0:1.8.4-4.el7

Vendor Advisories (1)

redhatCVE-2018-20615Important

haproxy: Mishandling of priority flag in short HEADERS frame by HTTP/2 decoder allows for crash

References

lists.opensuse.org / opensuse-security-announce/2019-02/msg00018.html

Mailing ListThird Party Advisory

access.redhat.com / errata/RHBA-2019:0327

Third Party Advisory

access.redhat.com / errata/RHSA-2019:0275

Third Party Advisory

usn.ubuntu.com / 3858-1

Third Party Advisory

mail-archive.com / haproxy%40formilux.org/msg32304.html

securityfocus.com / bid/106645

Third Party AdvisoryVDB Entry