CVE-2018-11469

—

CVSS 3.0

5.9 medium

EPSS

3%p87

Published

May 25, 2018 (May 25, 2018)

Modified

Jun 17, 2026

Description

Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 (if cache enabled) allows attackers to achieve information disclosure via an unauthenticated remote request, related to the proto_http.c check_request_for_cacheability function.

Vendors: haproxy canonical
Products: haproxy, ubuntu linux
Weakness: CWE-200
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (3.0%)

In the news0 stories

No ingested article mentions this CVE yet.