09/01/2026
Cybersecurity Insights
Publication of a Security Audit Report performed on HAProxy
Thibaut FRIN & Sam NZONGANI
Our Security Evaluation Laboratory performed a security audit of HAProxy. This audit was aimed at evaluating the security level of HAProxy, focusing on code source analysis, fuzzing and dynamic penetration testing (configuration handling, authentication and ACL, network parsing and configuration handling).
This security audit was funded by the French cybersecurity agency (ANSSI) as part of its efforts to support the security assessment of open source software (more info here).
The audit showed that HAProxy is very mature and goes a long way to protect its memory by reimplementing some of the libc functions. It uses its own structures to handle these operations. Its attack surface is also very limited, exposing a few entry points accessible by potential attackers.
The static source code analysis did not reveal any issue in the memory manipulation functions implemented by the developer. The internal parsing functions for administration commands and configuration loading are correctly implemented as well as network requests handling. The internal sockets are also secured and robust.
The dynamic analysis and pentest revealed flaws in some configuration parameters handling due to a lack of control. This leads to integer overflows that can lead to memory corruptions. A way to bypass path ACL has been found. However, this is known by the developer and has not been fixed in years for compatibility issues. Recommendations in the documentation can help users to avoid protecting resources this way.
Almond, ANSSI and HAProxy decided to share a public version of the audit report to improve the security and transparency of this process.
