Is HAProxy 2.5.14 affected?

CVSS 8.2

2 known vulnerabilities affect 2.5.14 (highest CVSS 8.2).

Your branch 2.5 has reached end of life (May 2, 2023).

25 newer releases in its track, up to 3.4.7. What changed up to 3.4.7

Vulnerabilities affecting 2.5.14

8.2
CVE-2023-45539 HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end… fixed in 2.8.2
7.2
CVE-2023-40225 HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length head… fixed in 2.6.15