CVE-2018-20615

Name of the Vulnerable Software and Affected Versions: HAProxy versions 1.8.x through 1.9.0

Description: An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder, which can result in a crash. The issue arises from the processing of the PRIORITY flag in a HEADERS frame, where 5 extra bytes are required but not properly checked, potentially leading to a denial of service. This can be exploited by a remote attacker using a specially crafted packet.

Recommendations: For HAProxy versions 1.8.x through 1.9.0, consider disabling the HTTP/2 protocol decoder until a patch is available to prevent potential crashes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.