{"id":"CVE-2023-0836","details":"An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.","aliases":["BIT-haproxy-2023-0836"],"modified":"2026-09-10T11:30:45.852814505Z","published":"2023-03-29T00:00:00Z","related":["ALSA-2023:6496"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0836.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"HAProxy 2.8, HAProxy 2.7.1, HAProxy 2.6.8, HAProxy 2.5.11, HAProxy 2.4.21, HAProxy 2.2.27"},{"last_affected":"HAProxy 2.8, HAProxy 2.7.1, HAProxy 2.6.8, HAProxy 2.5.11, HAProxy 2.4.21, HAProxy 2.2.27"}]},{"extracted_events":[{"introduced":"2.2"},{"fixed":"2.2.27"},{"introduced":"2.4"},{"fixed":"2.4.21"},{"introduced":"2.5"},{"fixed":"2.5.11"},{"introduced":"2.6"},{"fixed":"2.6.8"},{"introduced":"2.7"},{"fixed":"2.7.1"}],"source":"DESCRIPTION"}],"cna_assigner":"redhat","cwe_ids":["CWE-200"]},"references":[{"type":"WEB","url":"https://git.haproxy.org/?p=haproxy.git%3Ba=commitdiff%3Bh=2e6bf0a"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0836.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0836"},{"type":"ADVISORY","url":"https://www.debian.org/security/2023/dsa-5388"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/haproxy/haproxy","events":[{"introduced":"f2e0833f16aa8c09e1c7001ff55aac4f13c643b7"},{"last_affected":"b4d0cd02c14d4db1cf54b0bd8ee328fb198553f3"},{"introduced":"a1efc048bf8a5e14466dbe7317e73117e8d66176"},{"last_affected":"026fef98a014b9860f7058eae437ff0a11c78e20"},{"introduced":"e54b43af1ec9dc656c04b09118583cb3c2ce56fa"},{"last_affected":"437fd289f2e32e56498d2d4da63852d483f284ef"}],"database_specific":{"extracted_events":[{"introduced":"2.5.0"},{"last_affected":"2.5.11"},{"introduced":"2.6.0"},{"last_affected":"2.6.8"},{"introduced":"2.1.0"},{"last_affected":"2.1.0"},{"introduced":"2.3.0"},{"last_affected":"2.3.0"},{"introduced":"2.7.0"},{"last_affected":"2.7.0"}],"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*","cpe:2.3:a:haproxy:haproxy:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:haproxy:haproxy:2.3.0:*:*:*:*:*:*:*","cpe:2.3:a:haproxy:haproxy:2.7.0:*:*:*:*:*:*:*"]}}],"versions":["2.1.0","2.3.0","2.7.0","v2.7.0","v2.7-dev10","v2.7-dev9","v2.7-dev8","v2.7-dev7","v2.7-dev6","v2.7-dev5","v2.7-dev4","v2.7-dev3","v2.7-dev2","v2.7-dev1","v2.7-dev0","v2.6.0","v2.6-dev8","v2.6-dev7","v2.6-dev6","v2.6-dev5","v2.6-dev4","v2.6-dev3","v2.6-dev2","v2.6-dev1","v2.6-dev0","v2.5.0","v2.5-dev11","v2.5-dev10","v2.5-dev9","v2.5-dev8","v2.5-dev7","v2.5-dev6","v2.5-dev5","v2.5-dev4","v2.5-dev3","v2.5-dev2","v2.5-dev1","v2.5-dev0","v2.4.0","v2.4-dev19","v2.4-dev18","v2.4-dev17","v2.4-dev16","v2.4-dev15","v2.4-dev14","v2.4-dev13","v2.4-dev12","v2.4-dev11","v2.4-dev10","v2.4-dev9","v2.4-dev8","v2.4-dev7","v2.4-dev6","v2.4-dev5","v2.4-dev4","v2.4-dev3","v2.4-dev2","v2.4-dev1","v2.4-dev0","v2.3.0","v2.3-dev9","v2.3-dev8","v2.3-dev7","v2.3-dev6","v2.3-dev5","v2.3-dev4","v2.3-dev3","v2.3-dev2","v2.3-dev1","v2.3-dev0","v2.2.0","v2.2-dev12","v2.2-dev11","v2.2-dev10","v2.2-dev9","v2.2-dev8","v2.2-dev7","v2.2-dev6","v2.2-dev5","v2.2-dev4","v2.2-dev3","v2.2-dev2","v2.2-dev1","v2.2-dev0","v2.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-0836.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}