CVE-2023-0836

score

<0.1

cvss

7.5

epss

1.2%

published

2023-03-29

kev added

—

first seen

2026-10-21

HAProxy versions 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, and 2.7 before 2.7.1 contain an information disclosure caused by uninitialized buffer bytes in FCGI_BEGIN_REQUEST encoding, letting sensitive data be disclosed to FastCGI backends, exploit requires specific request handling.