BIT-haproxy-2021-40346

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/haproxy/BIT-haproxy-2021-40346.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-haproxy-2021-40346
Aliases
Published
2024-03-06T10:54:15.896Z
Modified
2024-03-06T11:25:28.861Z
Summary
[none]
Details

An integer overflow exists in HAProxy 2.0 through 2.5 in htxaddheader that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.

Database specific
{
    "cpes": [
        "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
}
References

Affected packages

Bitnami / haproxy

Package

Name
haproxy
Purl
pkg:bitnami/haproxy

Severity

  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
2.0.0
Fixed
2.0.25
Introduced
2.2.0
Fixed
2.2.17
Introduced
2.3.0
Fixed
2.3.14
Introduced
2.4.0
Fixed
2.4.4