CVE-2012-2942: Buffer overflow in the trash buffer in the header capture functionality in HAProxy before 1.4.21, when glob...

Security readout for executives and security teams

This is an old HAProxy flaw where a specific non-default configuration could let a remote attacker crash the proxy and possibly run code. The affected component often sits in front of critical web services, so confirmed exposure should be treated seriously even though the sources do not show active exploitation. Exposure is limited to HAProxy deployments older than 1.4.21 with the vulnerable configuration: increased global.tune.bufsize plus header rewriting and header capture functionality. Internet-facing reverse proxies or load balancers would be the primary concern. Prioritize remediation if any internet-facing or business-critical HAProxy instance matches the old version and configuration. Otherwise, treat this as a legacy exposure cleanup item and verify it is absent from inherited infrastructure. Mitigation focus: Upgrade HAProxy to 1.4.21 or later, or apply the relevant distribution security update.; Review Debian, Ubuntu, Gentoo, or vendor guidance for packaged HAProxy remediation.; Identify and replace unsupported HAProxy 1.4-era deployments..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.