CVE-2025-32464

Executive Summary

CVE-2025-32464 is a heap-based buffer overflow vulnerability in HAProxy versions 2.2 through 3.1.6. The flaw resides in the sample_conv_regsub function, which mishandles the replacement of multiple short patterns with a longer one in certain uncommon configurations. An attacker can trigger this overflow by sending crafted HTTP requests that exploit the pattern replacement logic, leading to a denial of service (DoS) condition or potentially arbitrary code execution. The vulnerability has a CVSS score of 6.8 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept (PoC) or patch is currently available.

Supply Chain & Package Security

HAProxy is a widely used open-source load balancer and proxy server, often deployed in critical infrastructure. This vulnerability affects the core binary, not a package manager ecosystem (NPM, PyPI, Go, Ruby). However, organizations using HAProxy in containerized environments should verify the integrity of their images and ensure they are not running vulnerable versions.

CVSS Breakdown & Threat Level

• CVSS Score: 6.8 (Medium)
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)

The primary threat is denial of service, as the overflow can crash the HAProxy process. In worst-case scenarios, code execution may be possible, but this is unconfirmed.

Deep Dive & Mechanics

The vulnerability exists in the sample_conv_regsub function within HAProxy's sample conversion framework. This function is used to perform regex-based substitution on sample data (e.g., HTTP headers, URI parts). When multiple short patterns are replaced with a single longer pattern, the function fails to properly reallocate the output buffer, leading to a heap-based buffer overflow.

Root Cause: The function calculates the required buffer size based on the original input length and the replacement pattern length. However, when multiple short patterns are replaced with a longer one, the cumulative output length exceeds the initial allocation, causing a write beyond the allocated heap memory.

Trigger Condition: The vulnerability requires an uncommon configuration where http-request set-var or similar directives use regsub with multiple short patterns and a longer replacement. An attacker can craft HTTP requests that match these patterns, triggering the overflow.

Vulnerable vs. Patched Code

Vulnerable Code (HAProxy 3.1.6):

// Simplified vulnerable logic
static int sample_conv_regsub(const struct arg *args, struct sample *smp, void *private) {
    char *output = malloc(smp->data.u.str.len + 1);
    // ... regex matching and replacement logic ...
    // Buffer overflow occurs when replacement is longer than original
    strcat(output, replacement); // No bounds checking
}

Patched Code (Hypothetical):

// Patched version with proper size calculation
static int sample_conv_regsub(const struct arg *args, struct sample *smp, void *private) {
    size_t max_output = smp->data.u.str.len * 2 + 1; // Conservative estimate
    char *output = malloc(max_output);
    // ... regex matching and replacement logic with bounds checking ...
    if (strlen(output) + strlen(replacement) >= max_output) {
        // Reallocate or truncate
    }
}

Exploitation & Lab Setup

Red Team (Attacker)

1. Setup: Deploy a vulnerable HAProxy instance (version 3.1.6) with a configuration that uses regsub for pattern replacement. Example config:

   frontend http-in
       bind *:80
       http-request set-var(txn.test) url,regsub("(a|b|c)","XYZ")
   

2. Craft Payload: Send an HTTP request with a URI containing multiple short patterns (e.g., /abcabcabc). The replacement XYZ is longer than each pattern, causing overflow.
3. Trigger: Use a tool like curl or custom Python script:

   import socket
   s = socket.socket()
   s.connect(("target", 80))
   s.send(b"GET /abcabcabc HTTP/1.1\r\nHost: target\r\n\r\n")
   

4. Observe: HAProxy crashes or becomes unresponsive.

Blue Team (Defender)

1. Detection: Monitor for crashes or abnormal memory usage in HAProxy logs.
2. Mitigation: Disable regsub usage in configurations if not needed. Apply rate limiting to reduce attack surface.
3. Forensics: Capture memory dumps of crashed HAProxy processes for analysis.

Indicators of Compromise (IOCs)

• Network: HTTP requests with URIs containing repeated short patterns (e.g., /abcabcabc).
• Logs: HAProxy logs showing FATAL or SEGV errors, or entries with sample_conv_regsub function calls.
• Memory: Heap corruption patterns in crash dumps.
• File: Modified HAProxy binary or configuration files (unlikely).

Detection Engineering

YARA Rule

rule CVE_2025_32464_HAProxy_HeapOverflow {
    meta:
        description = "Detects HAProxy binary vulnerable to CVE-2025-32464"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-32464"
    strings:
        $vuln_func = "sample_conv_regsub" ascii wide
        $vuln_pattern = "regsub" ascii wide
    condition:
        $vuln_func and $vuln_pattern
}

Sigma Rule

title: CVE-2025-32464 HAProxy Heap Overflow Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests targeting HAProxy with patterns that may trigger CVE-2025-32464
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: haproxy
detection:
    selection:
        http.method: "GET"
        http.uri|contains: 
            - "abcabcabc"
            - "xyzxyzxyz"
    condition: selection
falsepositives:
    - Legitimate use of similar patterns
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32464 HAProxy Heap Overflow Attempt"; flow:to_server; content:"GET"; http_method; content:"abcabcabc"; http_uri; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: No official patch available. Monitor HAProxy's official repository for updates.
2. Workaround: Remove or modify HAProxy configurations that use regsub with multiple short patterns and longer replacements.
3. Mitigation:
   • Restrict access to HAProxy using firewall rules.
   • Enable rate limiting and request size limits.
   • Use Web Application Firewall (WAF) to filter suspicious patterns.
4. Detection: Deploy the provided YARA, Sigma, and Suricata rules to monitor for exploitation attempts.

Valters IT
DevSecOps & Cyber Threat Intelligence