HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service (uninitialized memory access and crash) or possibly have unspecified other impact via unknown vectors.
{
"versions": [
{
"introduced": "0"
},
{
"last_affected": "1.6.0"
},
{
"introduced": "0"
},
{
"last_affected": "1.6.1"
},
{
"introduced": "0"
},
{
"last_affected": "1.6.2"
},
{
"introduced": "0"
},
{
"last_affected": "1.6.3"
},
{
"introduced": "0"
},
{
"last_affected": "1.6.4"
},
{
"introduced": "0"
},
{
"last_affected": "1.6.5"
}
]
}