CVE-2022-0711 is a high-severity denial-of-service vulnerability affecting HAProxy, Debian, and Red Hat products. The flaw stems from HAProxy's improper handling of "Set-Cookie2" headers in HTTP responses, allowing an attacker to trigger an infinite loop with crafted packets. This unauthenticated attack has a low complexity and primarily impacts system availability. While the vulnerability has a high FAUCET Risk Score of 98/100 and a notable EPSS score, there is currently no evidence of active exploitation, public exploit code, or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.2.0, < 2.2.21CPE matchmatch criteria | cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* | ||
>= 2.3.0, < 2.3.18CPE matchmatch criteria | cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* | ||
>= 2.4.0, < 2.4.13CPE matchmatch criteria | cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* | ||
4.0CPE matchmatch criteria | cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.
Mar 8, 2022haproxy: Denial of service via set-cookie2 header
Feb 23, 2022