CVE-2019-11323: Haproxy

Medium severity, CVSS 5.9. EPSS: 1.3% chance of exploitation in the next 30 days.

HAProxy before 1.9.7 mishandles a reload with rotated keys, which triggers use of uninitialized, and very predictable, HMAC keys. This is related to an include/types/ssl_sock.h error.

Affected products

• Haproxy Haproxy: from 1.9.2, before 1.9.7 (fixed in 1.9.7)

Published 2019-05-09. Last modified 2026-06-17.