CVE-2024-49214

What it actually does

QUIC implementation allows 0-RTT session establishment using a spoofed source IP address, bypassing configured IP allow and block lists in affected HAProxy versions.

Why it matters to the business

Attackers can reach services or APIs that should be restricted by IP address, increasing risk of unauthorized access or data exposure until systems are updated.

How an attack unfolds

An attacker identifies a HAProxy instance using QUIC, crafts a 0-RTT QUIC packet with a spoofed source IP that matches an allowed entry, and completes the handshake to establish a session that evades IP filtering rules.

How to fix it

Upgrade HAProxy to a fixed version containing commit f627b9272bd8ffca6f2f898bfafc6bf0b84b7d46 (3.1-dev7, 3.0.5, or 2.9.11 or later) and restart the service. If immediate upgrade is not possible, disable QUIC or add compensating network-layer IP filtering.

How to confirm the fix worked

Verify running version is at or above the fixed commit, then test that spoofed 0-RTT QUIC connections are rejected by the IP allow/block list and confirm normal 0-RTT behavior for legitimate IPs.

Typical attack path

1. Scan for exposed HAProxy endpoints supporting QUIC
2. Select a source IP address permitted by the target's allow list
3. Craft and transmit a spoofed 0-RTT QUIC initial packet
4. Complete session establishment and issue subsequent requests
5. Access resources normally blocked by IP-based rules

How to detect it

Inspect HAProxy logs for QUIC 0-RTT handshake entries and cross-reference source IP addresses against expected client locations; look for successful connections from IPs that should have been blocked.

What your security team should do

• Prioritize upgrade of all HAProxy instances using QUIC to the listed fixed versions
• Review and tighten IP allow lists to reduce reliance on this control
• Monitor for post-upgrade validation and schedule regression testing of QUIC traffic