HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.
{ "cpes": [ "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*" ], "severity": "High" }