CVE-2023-0056: fedoraproject extra_packages_for_enterprise_linux Uncontrolled Resource Consumption
Vulnerability summary
CVE-2023-0056 is a medium (CVSS 6.5) Uncontrolled Resource Consumption vulnerability in fedoraproject extra_packages_for_enterprise_linux. EPSS estimates a 1.83% chance of exploitation in the next 30 days, higher than 78.9% of scored vulnerabilities.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 9 · Related 13Timeline
- 23-03-2023PublishedVulnerability first disclosed.
- 25-02-2025Last modifiedVulnerability information updated.
Description
An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · Red hatEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.83%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.83% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat10 products
- ceph_storage5.0
- openshift_container_platform4.12 | 4.10 | 4.11
- openshift_container_platform_for_ibm_linuxone4.12 | 4.10 | 4.11
- openshift_container_platform_for_power4.12 | 4.10 | 4.11
- openshift_container_platform_ibm_z_systems4.12 | 4.10 | 4.11
Chainguard7 products
- haproxy-2.4All versions (No fix recorded)
- haproxy-2.6All versions (No fix recorded)
- haproxy-2.8All versions (No fix recorded)
- haproxy-3.0All versions (No fix recorded)
- haproxy-3.1All versions (No fix recorded)
Fedoraproject2 products
- extra_packages_for_enterprise_linux8.0
- fedoraEOL36 | 37
Opensuse2 products
- haproxy&distro=openSUSE Leap 15.4< 2.4.8+git0.d1f8d41e0-150400.3.6.1
- haproxy&distro=openSUSE Leap Micro 5.3< 2.4.8+git0.d1f8d41e0-150400.3.6.1
Suse2 products
- haproxy&distro=SUSE Linux Enterprise High Availability Extension 15 SP4< 2.4.8+git0.d1f8d41e0-150400.3.6.1
- haproxy&distro=SUSE Linux Enterprise Micro 5.3< 2.4.8+git0.d1f8d41e0-150400.3.6.1
Wolfi2 products
- haproxy-3.2< 3.2.4-r1
- haproxy-3.3< 3.3.2-r0
Debian1 product
- haproxy< 2.6.8-1
Haproxy1 product
- haproxyna
Ubuntu1 product
- haproxy< 2.0.29-0ubuntu1.1 | < 2.4.18-0ubuntu1.1
9 vendors · 28 products
