CVE-2019-14243: haproxy proxyprotocol Improper Input Validation
Vulnerability summary
CVE-2019-14243 is a high (CVSS 7.5) Improper Input Validation vulnerability in haproxy proxyprotocol. EPSS estimates a 4.29% chance of exploitation in the next 30 days, higher than 91% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 23-07-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
headerv2.go in mastercactapus proxyprotocol before 0.0.2, as used in the mastercactapus caddy-proxyprotocol plugin through 0.0.2 for Caddy, allows remote attackers to cause a denial of service (webserver panic and daemon crash) via a crafted HAProxy PROXY v2 request with truncated source/destination address data.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · GoEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
4.29%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
0.00 pp
From 4.29% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundProxyprotocol
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Github.com/mastercactapus1 product
- proxyprotocol< 0.0.2
Haproxy1 product
- proxyprotocol< 0.0.2
2 vendors · 2 products
References
9 links- github.com/mastercactapus/proxyprotocol/issues/1X Refsource MISCExploitThird Party AdvisoryWEBREPORT
- github.com/mastercactapus/caddy-proxyprotocol/issues/8X Refsource MISCIssue TrackingThird Party AdvisoryWEB
- github.com/mastercactapus/proxyprotocol/compare/ef496d7...5c4a101X Refsource MISCThird Party AdvisoryWEB
- github.com/mastercactapus/proxyprotocol/commit/5c4a101121fc3e868026189c7a73f7f19eef90acX Refsource MISCPatchThird Party AdvisoryWEBFIX
- github.com/mastercactapus/proxyprotocol/releases/tag/v0.0.2X Refsource MISCRelease NotesThird Party AdvisoryWEB
