CVE-2016-5360

What it actually does

A reqdeny rule in HAProxy 1.6.x before 1.6.6 triggers access to uninitialized memory, resulting in a crash or undefined behavior.

Why it matters to the business

Service outages from crashes that interrupt load-balanced traffic, with potential for broader impact depending on deployment.

How an attack unfolds

An unauthenticated remote attacker sends HTTP requests crafted to match a reqdeny rule, causing the server to dereference uninitialized memory and either crash or exhibit other undefined behavior.

How to fix it

Upgrade HAProxy to version 1.6.6 or later; apply vendor patches for affected distributions such as Ubuntu.

How to confirm the fix worked

Confirm the running HAProxy binary reports version 1.6.6 or newer; test that reqdeny rules no longer trigger crashes under load.

Typical attack path

1. Identify a HAProxy instance running version 1.6.x before 1.6.6 that uses reqdeny rules
2. Craft and send HTTP requests that trigger the deny condition
3. Observe crash or memory corruption side effects

How to detect it

Search load-balancer and system logs for unexpected HAProxy process crashes or segmentation faults around the time of request processing; correlate with traffic that would match deny rules.

What your security team should do

• Prioritize upgrade of all HAProxy 1.6.x instances to 1.6.6+
• Review configurations for reqdeny usage and replace with safer alternatives where possible
• Monitor for service restarts or crashes in load-balancer logs