CVE-2013-2175: HAProxy 1.4 before 1.4.24 and 1.5 before 1.5-dev19, when configured to use hdr_ip or other "hdr_*" function...

Security readout for executives and security teams

This is a HAProxy denial-of-service issue. An attacker could send specially formed HTTP headers that crash HAProxy, but only where older HAProxy versions use hdr_ip or related hdr_* configuration functions with a negative occurrence count. The documented business impact is service interruption, not data theft. Exposure is limited to HAProxy deployments running the affected versions and using hdr_ip or other hdr_* functions with negative occurrence counts. Internet-facing reverse proxies, load balancers, and API gateways using such rules are the most relevant assets to check. Prioritize remediation where HAProxy is internet-facing or protects critical applications. The issue is old and configuration-dependent, but a crash in a front-door proxy can still create visible service downtime. Mitigation focus: Upgrade HAProxy 1.4 deployments to 1.4.24 or later.; Upgrade HAProxy 1.5-dev deployments to 1.5-dev19 or later.; Review HAProxy rules for hdr_ip or hdr_* functions with negative occurrence counts..

Prepared

Jun 14, 2026, 21:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.