CVE-2021-40346

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-40346
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-40346.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-40346
Aliases
Downstream
Related
Published
2021-09-08T17:15:12.457Z
Modified
2026-03-15T22:42:50.791150Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

An integer overflow exists in HAProxy 2.0 through 2.5 in htxaddheader that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.

References

Affected packages

Git / git.haproxy.org/haproxy-2.0.git

Affected ranges

Type
GIT
Repo
https://git.haproxy.org/haproxy-2.0.git
Events
Introduced
ba23630ad009464dc8e4d01dac9ce779eb84cc2a
Fixed
6986403b83388dff69b0d4cda2ab144b7b516936
Database specific 
{
    "versions": [
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.0.25"
        }
    ]
}
Type
GIT
Repo
https://git.haproxy.org/haproxy-2.2.git
Events
Introduced
3a00c915fd241fc398a080a11ccac9c5c46791ce
Fixed
dd94a25981b3e2a58e7c1b23b713267a7829a396
Database specific 
{
    "versions": [
        {
            "introduced": "2.2.0"
        },
        {
            "fixed": "2.2.17"
        }
    ]
}
Type
GIT
Repo
https://git.haproxy.org/haproxy-2.3.git
Events
Introduced
1c0a722a83e7c45456a2b82c15889ab9ab5c4948
Fixed
83c5b44d7395a7b4902d8be6c69844ad1841b0eb
Database specific 
{
    "versions": [
        {
            "introduced": "2.3.0"
        },
        {
            "fixed": "2.3.14"
        }
    ]
}
Type
GIT
Repo
https://github.com/haproxy/haproxy
Events
Introduced
6cbbecf09734aeb5fa8bb88f36f06a6f6d35e813
Fixed
4d711760de1ca0a3734a0a813cb0012dc3d2628a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f2e0833f16aa8c09e1c7001ff55aac4f13c643b7
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
96a2f50b51e6c498196762cc4a137075c0e91994
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
bccc91d33ece3591447df04f90e28664b06528b0
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
8441deb1e2287b8f86c575e5b1d350853f7f97d7
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
08d0f2313862bfacab7a84cdbe70508bef50a393
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
446344ccef8d5e1358394da7bd0de8625cb2bcb8
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f653e83064345fc303597af6c6aff44a704e5477
Fixed
3b69886f7dcc3cfb3d166309018e6cfec9ce2c95
Database specific 
{
    "versions": [
        {
            "introduced": "2.4.0"
        },
        {
            "fixed": "2.4.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.5-dev0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.5-dev1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.5-dev2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.5-dev3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.5-dev4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.5-dev5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.5-dev6"
        }
    ]
}

Affected versions

v2.*
v2.0.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.16
v2.0.17
v2.0.18
v2.0.19
v2.0.2
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.24
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.12
v2.2.13
v2.2.14
v2.2.15
v2.2.16
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0
v2.3.1
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.2
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
v2.4.0

Database specific

vanir_signatures 
[
    {
        "digest": {
            "length": 397.0,
            "function_hash": "250362322674641590349589051495230156653"
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2021-40346-720f56ce",
        "target": {
            "function": "htx_add_trailer",
            "file": "include/haproxy/htx.h"
        },
        "source": "https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95"
    },
    {
        "digest": {
            "length": 397.0,
            "function_hash": "137971134793007557031146476273999624430"
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2021-40346-a2320c5c",
        "target": {
            "function": "htx_add_header",
            "file": "include/haproxy/htx.h"
        },
        "source": "https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95"
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "103378957073333009210878063361820249918",
                "90642999860060403562236023336123966002",
                "87325895267160897988184542515128014985",
                "258426726845170808120248969356574058873",
                "156690178870054102966697089710863666198",
                "97589094008776621651354770360189691565"
            ]
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line",
        "id": "CVE-2021-40346-ff6b9c62",
        "target": {
            "file": "include/haproxy/htx.h"
        },
        "source": "https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95"
    }
]
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "11.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "33"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "34"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-40346.json"