CVE-2022-0711: debian debian_linux Loop with Unreachable Exit Condition
Vulnerability summary
CVE-2022-0711 is a high (CVSS 7.5) Loop with Unreachable Exit Condition vulnerability in debian debian_linux. EPSS estimates a 16.56% chance of exploitation in the next 30 days, higher than 97% of scored vulnerabilities.
Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 17% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2Timeline
- 02-03-2022PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
16.56%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
No change 0.00 pp
From 16.56% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat10 products
- enterprise_linuxEOL7.0 | 8.0
- openshift_container_platform4.0
- software_collectionsna
- haproxy< 0:2.2.13-3.el8 | < 0:2.0.19-3.el7 | < 0:2.0.19-3.el8
- haproxy-debuginfo< 0:2.0.19-3.el7
Debian2 products
- haproxy< 2.2.9-2+deb11u3 | < 2.4.13-1
- debian_linuxEOL11.0
Opensuse2 products
- haproxy&distro=openSUSE Leap 15.4< 2.4.8+git0.d1f8d41e0-150400.3.3.13
- haproxy&distro=openSUSE Tumbleweed< 2.5.4+git0.e55ab4208-1.1
Alpine1 product
- haproxy≥ 2.2.0, < 2.2.21-r0
Haproxy1 product
- haproxy≥ 2.2.0, < 2.2.21 | ≥ 2.3.0, < 2.3.18 | ≥ 2.4.0, < 2.4.13
Suse1 product
- haproxy&distro=SUSE Linux Enterprise High Availability Extension 15 SP4< 2.4.8+git0.d1f8d41e0-150400.3.3.13
Ubuntu1 product
- haproxy< 2.0.13-2ubuntu0.5
7 vendors · 18 products
References
21 links- www.mail-archive.com/haproxy%40formilux.org/msg41833.htmlX Refsource MISC
- github.com/haproxy/haproxy/commit/bfb15ab34ead85f64cd6da0e9fb418c9cd14cee8X Refsource MISCPatchThird Party Advisory
