CVE-2020-11100
HighIn hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.
Published Apr 2, 2020 · Updated Sep 8, 2026 · Also known as ALPINE-CVE-2020-11100, BIT-haproxy-2020-11100, DEBIAN-CVE-2020-11100, DSA-4649-1, SUSE-SU-2020:0851-1, SUSE-SU-2020:0852-1, UBUNTU-CVE-2020-11100, USN-4321-1
Key Facts
Patch immediately- CVE-2020-11100 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Haproxy, Openshift Container Platform (Redhat), Ubuntu Linux (Canonical) and 5 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 62% probability of exploitation in the next 30 days.
- Fixed versions are available, including Haproxy 0:1.8.15-6.el8_1.1, Haproxy 0:2.0.13-3.el7, Haproxy 1.8.15-6.el8_1.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
62%
Higher than 99.1% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2020-11100 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.
Affected Products
55 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| HaproxyHaproxy | >= 1.8.0 | 2.1.4 |
| Openshift Container PlatformRedhat | 3.11, 4.0 | n/a |
| Ubuntu LinuxCanonical | 18.04, 19.10 | n/a |
| Debian LinuxDebian | 10.0 | n/a |
| FedoraFedoraproject | 30, 31 | n/a |
Patched Releases
Haproxy
0:1.8.15-6.el8_1.1, 0:2.0.13-3.el7, 1.8.15-6.el8_1.1, 1.8.19-1+deb10u2, 1.8.25-r0, 1.8.8-1ubuntu0.10, 2.0.10-2.ph1, 2.0.10-2.ph2, 2.0.10-2.ph3, 2.0.10+git0.ac198b92-3.19.1, 2.0.10+git0.ac198b92-8.12.1, 2.0.10+git0.ac198b92-lp151.2.9.1, 2.0.13-2, 2.0.14-r0, 2.0.21-r0, 2.0.25-r1, 2.1.4, 2.1.4-1, 2.1.4-r0, 2.4.4+git0.acb1d0bea-1.2
rh-haproxy18-haproxy
0:1.8.17-1.el7.1
rootio-haproxy
2.1.4-r0
Timeline
Publicly disclosed
Apr 2, 2020
Last updated
Sep 8, 2026
Weakness Type
- CWE-20 Improper Input Validation
- CWE-787 Out-of-bounds Write
References
- advisoryopenSUSE-SU-2020:0444
- advisoryhttp://packetstormsecurity.com/files/157323/haproxy-hpack-tbl.c-Out-Of-Bounds-Write.html
- advisoryRHSA-2020:1287
- advisoryRHSA-2020:1288
- advisoryRHSA-2020:1289
FAQ
Common Questions.
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.
Affected: Haproxy versions >= 1.8.0; Openshift Container Platform (Redhat) versions 3.11, 4.0; Ubuntu Linux (Canonical) versions 18.04, 19.10, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Haproxy 0:1.8.15-6.el8_1.1, Haproxy 0:2.0.13-3.el7, Haproxy 1.8.15-6.el8_1.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2020-11100 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo