HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling of the replacement of multiple short patterns with a longer one.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4135 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4135-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     April 23, 2025                                https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : haproxy     Version        : 2.2.9-2+deb11u7     CVE ID         : CVE-2025-32464     Debian Bug     : 1102673

    A heap buffer overflow in sample_conv_regsub() has been fixed in the     load balancing reverse proxy HAProxy.

    For Debian 11 bullseye, this problem has been fixed in version     2.2.9-2+deb11u7.

    We recommend that you upgrade your haproxy packages.

    For the detailed security status of haproxy please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/haproxy

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2025:1338-1 advisory.

    - CVE-2025-32464: Fixed heap-based buffer overflow in sample_conv_regsub. (bsc#1240971)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the haproxy package has been released.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:1264-1 advisory.

    - CVE-2025-32464: Fixed heap-based buffer overflow in sample_conv_regsub. (bsc#1240971)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7431-1 advisory.

    Aleandro Prudenzano and Edoardo Geraci discovered that HAProxy incorrectly handled certain uncommon     configurations that replace multiple short patterns with a longer one. A remote attacker could use this     issue to cause HAProxy to crash, resulting in a denial of service, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
234783	Debian dla-4135 : haproxy - security update	Nessus	Debian Local Security Checks	medium
234613	SUSE SLES15 Security Update : haproxy (SUSE-SU-2025:1338-1)	Nessus	SuSE Local Security Checks	medium
234494	Photon OS 4.0: Haproxy PHSA-2025-4.0-0781	Nessus	PhotonOS Local Security Checks	medium
234486	SUSE SLES15 / openSUSE 15 Security Update : haproxy (SUSE-SU-2025:1264-1)	Nessus	SuSE Local Security Checks	medium
234135	Ubuntu 22.04 LTS / 24.04 LTS / 24.10 : HAProxy vulnerability (USN-7431-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2025-32464

medium

Tenable Plugins

medium

medium

medium

medium

medium