HAProxy Heap-Based Buffer Overflow Vulnerability in Sample Conv Regsub Function

A heap-based buffer overflow vulnerability has been identified in HAProxy versions 2.2 through 3.1.6. This issue arises in certain uncommon configurations within the sample_conv_regsub() function, where the replacement of multiple short patterns with a longer one is mishandled. The vulnerability was introduced in version 2.2 and can be exploited by replacing multiple occurrences of a short pattern with a longer one, potentially overflowing the temporary buffer used for the replacement.

Impact

Exploitation of this vulnerability leads to a heap-based buffer overflow, which can commonly result in arbitrary code execution or memory corruption.

Remediation

Users can upgrade to HAProxy version 2.2.9-2+deb11u7 to address this vulnerability.