HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling of the replacement of multiple short patterns with a longer one.
The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Haproxy | Ubuntu | devel | * |
| Haproxy | Ubuntu | jammy | * |
| Haproxy | Ubuntu | noble | * |
| Haproxy | Ubuntu | oracular | * |