CVE-2021-40346

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2021-40346
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-40346.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-40346
Aliases
Downstream
Related
Published
2021-09-08T17:15:12Z
Modified
2025-10-27T04:12:29.934583Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

An integer overflow exists in HAProxy 2.0 through 2.5 in htxaddheader that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.

References

Affected packages

Git / git.haproxy.org/haproxy-2.0.git

Affected ranges

Type
GIT
Repo
https://git.haproxy.org/haproxy-2.0.git
Events
Introduced
ba23630ad009464dc8e4d01dac9ce779eb84cc2a
Fixed
6986403b83388dff69b0d4cda2ab144b7b516936

Affected versions

v2.*

v2.0.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.16
v2.0.17
v2.0.18
v2.0.19
v2.0.2
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.24
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9

Git / git.haproxy.org/haproxy-2.0.git

Affected ranges

Type
GIT
Repo
https://git.haproxy.org/haproxy-2.2.git
Events
Introduced
3a00c915fd241fc398a080a11ccac9c5c46791ce
Fixed
dd94a25981b3e2a58e7c1b23b713267a7829a396

Affected versions

v2.*

v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.12
v2.2.13
v2.2.14
v2.2.15
v2.2.16
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9

Git / git.haproxy.org/haproxy-2.0.git

Affected ranges

Type
GIT
Repo
https://git.haproxy.org/haproxy-2.3.git
Events
Introduced
1c0a722a83e7c45456a2b82c15889ab9ab5c4948
Fixed
83c5b44d7395a7b4902d8be6c69844ad1841b0eb

Affected versions

v2.*

v2.3.0
v2.3.1
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.2
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9

Git / git.haproxy.org/haproxy-2.0.git

Affected ranges

Type
GIT
Repo
https://git.haproxy.org/haproxy.git
Events
Introduced
6cbbecf09734aeb5fa8bb88f36f06a6f6d35e813
Fixed
4d711760de1ca0a3734a0a813cb0012dc3d2628a

Affected versions

v2.*

v2.4.0

Git / git.haproxy.org/haproxy-2.0.git

Affected ranges

Type
GIT
Repo
https://github.com/haproxy/haproxy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3b69886f7dcc3cfb3d166309018e6cfec9ce2c95

Affected versions

v1.*

v1.0.0
v1.0.1
v1.0.2
v1.1.0
v1.1.1
v1.1.10
v1.1.11
v1.1.12
v1.1.13
v1.1.14
v1.1.15
v1.1.16
v1.1.17
v1.1.18
v1.1.19
v1.1.2
v1.1.20
v1.1.21
v1.1.22
v1.1.23
v1.1.24
v1.1.25
v1.1.26
v1.1.27
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v1.2.0
v1.2.1
v1.2.1-pre1
v1.2.1-pre2
v1.2.1-pre3
v1.2.10
v1.2.10.1
v1.2.11
v1.2.11.1
v1.2.12
v1.2.13
v1.2.13.1
v1.2.14
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.2.5-pre1
v1.2.5-pre2
v1.2.5-pre3
v1.2.5-pre4
v1.2.5.1
v1.2.5.2
v1.2.6
v1.2.6-pre4
v1.2.6-pre5
v1.2.7
v1.2.7.1
v1.2.7rc
v1.2.8
v1.2.9
v1.3.0
v1.3.1
v1.3.10
v1.3.10.1
v1.3.10.2
v1.3.11
v1.3.11.1
v1.3.11.2
v1.3.11.3
v1.3.11.4
v1.3.12
v1.3.13
v1.3.14
v1.3.15
v1.3.16
v1.3.16-rc1
v1.3.16-rc2
v1.3.17
v1.3.18
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.3.6.1
v1.3.7
v1.3.8
v1.3.8.1
v1.3.8.2
v1.3.9
v1.4-dev0
v1.4-dev1
v1.4-dev2
v1.4-dev3
v1.4-dev4
v1.4-dev5
v1.4-dev6
v1.4-dev7
v1.4-dev8
v1.4-rc1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.5-dev10
v1.5-dev12
v1.5-dev13
v1.5-dev14
v1.5-dev15
v1.5-dev16
v1.5-dev17
v1.5-dev18
v1.5-dev19
v1.5-dev20
v1.5-dev21
v1.5-dev22
v1.5-dev23
v1.5-dev24
v1.5-dev25
v1.5-dev26
v1.5-dev8
v1.5-dev9
v1.5.0
v1.6-dev0
v1.6-dev1
v1.6-dev2
v1.6-dev3
v1.6-dev4
v1.6-dev5
v1.6-dev6
v1.6-dev7
v1.6.0
v1.7-dev0
v1.7-dev1
v1.7-dev2
v1.7-dev3
v1.7-dev4
v1.7-dev5
v1.7-dev6
v1.7.0
v1.8-dev0
v1.8-dev1
v1.8-dev2
v1.8-dev3
v1.8-rc1
v1.8-rc2
v1.8-rc3
v1.8-rc4
v1.8.0
v1.9-dev0
v1.9-dev1
v1.9-dev10
v1.9-dev11
v1.9-dev2
v1.9-dev3
v1.9-dev4
v1.9-dev5
v1.9-dev6
v1.9-dev7
v1.9-dev8
v1.9-dev9
v1.9.0

v2.*

v2.0-dev0
v2.0-dev1
v2.0-dev2
v2.0-dev3
v2.0-dev4
v2.0-dev5
v2.0-dev6
v2.0-dev7
v2.0.0
v2.1-dev0
v2.1-dev1
v2.1-dev2
v2.1-dev3
v2.1-dev4
v2.1-dev5
v2.1.0
v2.2-dev0
v2.2-dev1
v2.2-dev10
v2.2-dev11
v2.2-dev12
v2.2-dev2
v2.2-dev3
v2.2-dev4
v2.2-dev5
v2.2-dev6
v2.2-dev7
v2.2-dev8
v2.2-dev9
v2.2.0
v2.3-dev0
v2.3-dev1
v2.3-dev2
v2.3-dev3
v2.3-dev4
v2.3-dev5
v2.3-dev6
v2.3-dev7
v2.3-dev8
v2.3-dev9
v2.3.0
v2.4-dev0
v2.4-dev1
v2.4-dev10
v2.4-dev11
v2.4-dev12
v2.4-dev13
v2.4-dev14
v2.4-dev15
v2.4-dev16
v2.4-dev17
v2.4-dev18
v2.4-dev19
v2.4-dev2
v2.4-dev3
v2.4-dev4
v2.4-dev5
v2.4-dev6
v2.4-dev7
v2.4-dev8
v2.4-dev9
v2.4.0
v2.5-dev0
v2.5-dev1
v2.5-dev2
v2.5-dev3
v2.5-dev4
v2.5-dev5
v2.5-dev6

Database specific

vanir_signatures

[
    {
        "id": "CVE-2021-40346-720f56ce",
        "source": "https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95",
        "signature_version": "v1",
        "digest": {
            "length": 397.0,
            "function_hash": "250362322674641590349589051495230156653"
        },
        "target": {
            "function": "htx_add_trailer",
            "file": "include/haproxy/htx.h"
        },
        "signature_type": "Function",
        "deprecated": false
    },
    {
        "id": "CVE-2021-40346-a2320c5c",
        "source": "https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95",
        "signature_version": "v1",
        "digest": {
            "length": 397.0,
            "function_hash": "137971134793007557031146476273999624430"
        },
        "target": {
            "function": "htx_add_header",
            "file": "include/haproxy/htx.h"
        },
        "signature_type": "Function",
        "deprecated": false
    },
    {
        "id": "CVE-2021-40346-ff6b9c62",
        "source": "https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "103378957073333009210878063361820249918",
                "90642999860060403562236023336123966002",
                "87325895267160897988184542515128014985",
                "258426726845170808120248969356574058873",
                "156690178870054102966697089710863666198",
                "97589094008776621651354770360189691565"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "include/haproxy/htx.h"
        },
        "signature_type": "Line",
        "deprecated": false
    }
]