{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/haproxy/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["HAProxy"],"_cs_severities":["medium"],"_cs_tags":["security-bypass","denial-of-service","network-security"],"_cs_type":"advisory","_cs_vendors":["HAProxy"],"content_html":"\u003cp\u003eThe BSI has reported a vulnerability in HAProxy identified as CVE-2023-45538. This security flaw enables a remote, unauthenticated attacker to circumvent established security controls within the load balancer. By exploiting this issue, unauthorized actors may be able to perform unauthorized data manipulation or disrupt service availability, resulting in a Denial-of-Service (DoS) state. Given HAProxy's position as a critical infrastructure component for traffic routing and load balancing, the potential for unauthorized data inspection or traffic redirection is significant. Organizations utilizing HAProxy are advised to review the vulnerability documentation to determine the specific impact on their configuration and to apply relevant vendor patches as soon as they are made available to mitigate the risk of remote service disruption or unauthorized traffic handling.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability poses a risk of service interruption and data integrity compromise for any organization utilizing HAProxy in an internet-facing capacity. Successful exploitation can lead to a Denial-of-Service, impacting the availability of web applications and services relying on HAProxy for load balancing. Furthermore, the bypass of security restrictions may allow attackers to manipulate traffic streams, potentially leading to unauthorized access to downstream systems or data exfiltration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eIdentify all HAProxy instances within the environment using asset management tools or network discovery.\u003c/li\u003e\n\u003cli\u003eConsult the official HAProxy security documentation regarding CVE-2023-45538 to identify affected versions and verify if current configurations are susceptible.\u003c/li\u003e\n\u003cli\u003eApply vendor-provided security patches immediately once available to remediate the vulnerability.\u003c/li\u003e\n\u003cli\u003eImplement strict access control lists (ACLs) to limit management and configuration interfaces to trusted administrative networks.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-14T13:04:13Z","date_published":"2026-09-14T13:04:13Z","id":"https://feed.craftedsignal.io/briefs/2026-09-haproxy-bypass/","summary":"A vulnerability in HAProxy (CVE-2023-45538) allows remote, unauthenticated attackers to bypass security restrictions, manipulate data, and trigger denial-of-service conditions.","title":"HAProxy Security Bypass Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-09-haproxy-bypass/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.9,"id":"CVE-2026-22045"},{"cvss":9.1,"id":"CVE-2024-5535"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":[],"_cs_products":["Traefik","nginx","HAProxy","Caddy","Traefik (v3.7.0 \u003c= v3.7.7)","Traefik (\u003c 3.6.25)","Traefik (\u003e= 3.7.0, \u003c 3.7.10)","Traefik (\u003c 2.11.53, \u003c 3.6.24, \u003c 3.7.9)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Traefik Labs","nginx","HAProxy","Caddy","Traefik"],"content_html":"\u003cp\u003eThis threat involves the abuse of the acme-tls/1 ALPN extension to trigger denial-of-service conditions against TLS-enabled reverse proxies. Attackers initiate high volumes of TLS connections advertising the acme-tls/1 extension, a protocol intended only for ACME TLS-ALPN-01 certificate validation, and deliberately stall the handshake process. By failing to complete the handshake, the attacker forces the destination service to maintain open connection states, effectively exhausting available goroutines, worker threads, or accept queue depths. This exploitation pattern is specifically documented as a technique to target CVE-2026-22045, which affects services like Traefik that lack adequate handshake timeout enforcement. When performed at scale, this resource exhaustion results in a denial-of-service (DoS) for legitimate users. Defenders should monitor for repeated incomplete TLS sessions originating from non-authorized sources to identify exploitation attempts against edge infrastructure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to a denial of service on internet-facing reverse proxies and web application load balancers, impacting service availability. Affected infrastructure includes common reverse proxies such as Traefik, nginx, HAProxy, and Caddy. If handshake timeouts are not correctly configured, a relatively low-volume flood can exhaust server resources, causing service instability or total outage for the host.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize hardening of all internet-facing TLS listeners to prevent resource exhaustion.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Traefik and other reverse proxies to versions that explicitly address CVE-2026-22045 and related handshake-timeout vulnerabilities.\u003c/li\u003e\n\u003cli\u003eEnforce strict \u003ccode\u003essl_handshake_timeout\u003c/code\u003e settings at the listener level to bound the duration any connection can remain in a pending state.\u003c/li\u003e\n\u003cli\u003eRate-limit inbound TLS connections per source IP at the network perimeter to mitigate the impact of connection-flooding attacks.\u003c/li\u003e\n\u003cli\u003eConfigure the Elastic Agent \u003ccode\u003enetwork_traffic\u003c/code\u003e integration with \u003ccode\u003einclude_detailed_fields: true\u003c/code\u003e to ensure visibility into ALPN extension fields.\u003c/li\u003e\n\u003cli\u003eSuppress noise by creating allowlists for known ACME Certificate Authority IP ranges (e.g., Let's Encrypt, ZeroSSL, Buypass) and internal certificate renewal agents.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-06T21:30:08Z","date_published":"2026-08-05T21:11:55Z","id":"https://feed.craftedsignal.io/briefs/2026-08-stalled-tls-handshakes/","summary":"Attackers are exploiting unpatched TLS listeners by flooding them with incomplete ACME ALPN handshakes to exhaust server-side resources like goroutines and worker threads.","title":"Service Exhaustion via Stalled TLS ALPN Handshakes","url":"https://feed.craftedsignal.io/briefs/2026-08-stalled-tls-handshakes/"}],"language":"en","title":"CraftedSignal Threat Feed - HAProxy","version":"https://jsonfeed.org/version/1.1"}