CVE-2021-40346
- Source
- https://cve.org/CVERecord?id=CVE-2021-40346
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-40346.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2021-40346
- Aliases
- Downstream
- Related
- Published
- 2021-09-08T17:15:12.457Z
- Modified
- 2026-07-08T22:14:12.285895Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
An integer overflow exists in HAProxy 2.0 through 2.5 in htxaddheader that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.
- Database specific
{ "unresolved_ranges": [ { "extracted_events": [ { "introduced": "2.0.0" }, { "fixed": "2.0.25" }, { "introduced": "2.0.0" }, { "fixed": "2.0.25" }, { "introduced": "2.0.0" }, { "fixed": "2.0.25" }, { "introduced": "2.0.0" }, { "fixed": "2.0.25" }, { "introduced": "2.0.0" }, { "fixed": "2.0.25" }, { "introduced": "2.0.0" }, { "fixed": "2.0.25" }, { "introduced": "2.0.0" }, { "fixed": "2.0.25" }, { "introduced": "2.0.0" }, { "fixed": "2.0.25" }, { "introduced": "2.0.0" }, { "fixed": "2.0.25" }, { "introduced": "2.0.0" }, { "fixed": "2.0.25" }, { "introduced": "2.0.0" }, { "fixed": "2.0.25" }, { "introduced": "2.0.0" }, { "fixed": "2.0.25" }, { "introduced": "2.2.0" }, { "fixed": "2.2.17" }, { "introduced": "2.2.0" }, { "fixed": "2.2.17" }, { "introduced": "2.2.0" }, { "fixed": "2.2.17" }, { "introduced": "2.2.0" }, { "fixed": "2.2.17" }, { "introduced": "2.2.0" }, { "fixed": "2.2.17" }, { "introduced": "2.2.0" }, { "fixed": "2.2.17" }, { "introduced": "2.2.0" }, { "fixed": "2.2.17" }, { "introduced": "2.2.0" }, { "fixed": "2.2.17" }, { "introduced": "2.2.0" }, { "fixed": "2.2.17" }, { "introduced": "2.2.0" }, { "fixed": "2.2.17" }, { "introduced": "2.2.0" }, { "fixed": "2.2.17" }, { "introduced": "2.2.0" }, { "fixed": "2.2.17" }, { "introduced": "2.3.0" }, { "fixed": "2.3.14" }, { "introduced": "2.3.0" }, { "fixed": "2.3.14" }, { "introduced": "2.3.0" }, { "fixed": "2.3.14" }, { "introduced": "2.3.0" }, { "fixed": "2.3.14" }, { "introduced": "2.3.0" }, { "fixed": "2.3.14" }, { "introduced": "2.3.0" }, { "fixed": "2.3.14" }, { "introduced": "2.3.0" }, { "fixed": "2.3.14" }, { "introduced": "2.3.0" }, { "fixed": "2.3.14" }, { "introduced": "2.3.0" }, { "fixed": "2.3.14" }, { "introduced": "2.3.0" }, { "fixed": "2.3.14" }, { "introduced": "2.3.0" }, { "fixed": "2.3.14" }, { "introduced": "2.3.0" }, { "fixed": "2.3.14" } ], "source": "CPE_RANGE", "vendor_product": "haproxy:haproxy", "cpes": [ "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*" ] }, { "extracted_events": [ { "introduced": "11.0" }, { "last_affected": "11.0" } ], "source": "CPE_STRING", "vendor_product": "debian:debian_linux", "cpes": [ "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*" ] }, { "extracted_events": [ { "introduced": "33" }, { "last_affected": "33" }, { "introduced": "34" }, { "last_affected": "34" } ], "source": "CPE_STRING", "vendor_product": "fedoraproject:fedora", "cpes": [ "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*", "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*" ] }, { "extracted_events": [ { "introduced": "2.5-dev0" }, { "last_affected": "2.5-dev0" }, { "introduced": "2.5-dev0" }, { "last_affected": "2.5-dev0" }, { "introduced": "2.5-dev0" }, { "last_affected": "2.5-dev0" }, { "introduced": "2.5-dev0" }, { "last_affected": "2.5-dev0" }, { "introduced": "2.5-dev0" }, { "last_affected": "2.5-dev0" }, { "introduced": "2.5-dev0" }, { "last_affected": "2.5-dev0" }, { "introduced": "2.5-dev0" }, { "last_affected": "2.5-dev0" }, { "introduced": "2.5-dev0" }, { "last_affected": "2.5-dev0" }, { "introduced": "2.5-dev0" }, { "last_affected": "2.5-dev0" }, { "introduced": "2.5-dev0" }, { "last_affected": "2.5-dev0" }, { "introduced": "2.5-dev0" }, { "last_affected": "2.5-dev0" } ], "source": "CPE_STRING", "vendor_product": "haproxy:haproxy", "cpes": [ "cpe:2.3:a:haproxy:haproxy:2.5:dev0:*:*:*:*:*:*" ] } ] }- References
-
- https://lists.apache.org/thread.html/r284567dd7523f5823e2ce995f787ccd37b1cc4108779c50a97c79120%40%3Cdev.cloudstack.apache.org%3E
- https://lists.apache.org/thread.html/r8a58fd7a29808e5d27ee56877745e58dc4bb041b9af94601554e2a5a%40%3Cdev.cloudstack.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7V2IYO22LWVBGUNZWVKNTMDV4KINLFO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXTSBY2TEAXWZVFQM3CXHJFRONX7PEMN/
- https://www.mail-archive.com/haproxy%40formilux.org
- https://www.mail-archive.com/haproxy%40formilux.org/msg41114.html
- https://www.debian.org/security/2021/dsa-4968
- https://git.haproxy.org/?p=haproxy.git
- https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95
- https://jfrog.com/blog/critical-vulnerability-in-haproxy-cve-2021-40346-integer-overflow-enables-http-smuggling/
Affected packages
Git / github.com/haproxy/haproxy
Affected ranges
- Type
- GIT
- Repo
- https://github.com/haproxy/haproxy
- Events
-
IntroducedFixedIntroducedLast affectedFixed
- Database specific
{ "source": [ "CPE_RANGE", "CPE_STRING", "REFERENCES" ], "cpe": [ "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*", "cpe:2.3:a:haproxy:haproxy:2.5:dev0:*:*:*:*:*:*", "cpe:2.3:a:haproxy:haproxy:2.5:dev1:*:*:*:*:*:*", "cpe:2.3:a:haproxy:haproxy:2.5:dev2:*:*:*:*:*:*", "cpe:2.3:a:haproxy:haproxy:2.5:dev3:*:*:*:*:*:*", "cpe:2.3:a:haproxy:haproxy:2.5:dev4:*:*:*:*:*:*", "cpe:2.3:a:haproxy:haproxy:2.5:dev5:*:*:*:*:*:*", "cpe:2.3:a:haproxy:haproxy:2.5:dev6:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "2.4.0" }, { "fixed": "2.4.4" }, { "introduced": "2.5-dev0" }, { "last_affected": "2.5-dev0" }, { "introduced": "2.5-dev1" }, { "last_affected": "2.5-dev1" }, { "introduced": "2.5-dev2" }, { "last_affected": "2.5-dev2" }, { "introduced": "2.5-dev3" }, { "last_affected": "2.5-dev3" }, { "introduced": "2.5-dev4" }, { "last_affected": "2.5-dev4" }, { "introduced": "2.5-dev5" }, { "last_affected": "2.5-dev5" }, { "introduced": "2.5-dev6" }, { "last_affected": "2.5-dev6" } ] }
Affected versions
2.*
2.5-dev0
2.5-dev1
2.5-dev2
2.5-dev3
2.5-dev4
2.5-dev5
2.5-dev6
v2.*
v2.4.0
v2.5-dev0
v2.5-dev1
v2.5-dev2
v2.5-dev3
v2.5-dev4
v2.5-dev5
v2.5-dev6
Database specific
vanir_signatures_modified
"2026-07-08T22:14:12Z"
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-40346.json"
vanir_signatures
[
{
"id": "CVE-2021-40346-720f56ce",
"digest": {
"function_hash": "250362322674641590349589051495230156653",
"length": 397.0
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95",
"deprecated": false,
"target": {
"function": "htx_add_trailer",
"file": "include/haproxy/htx.h"
}
},
{
"id": "CVE-2021-40346-a2320c5c",
"digest": {
"function_hash": "137971134793007557031146476273999624430",
"length": 397.0
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95",
"deprecated": false,
"target": {
"function": "htx_add_header",
"file": "include/haproxy/htx.h"
}
},
{
"id": "CVE-2021-40346-ff6b9c62",
"digest": {
"line_hashes": [
"103378957073333009210878063361820249918",
"90642999860060403562236023336123966002",
"87325895267160897988184542515128014985",
"258426726845170808120248969356574058873",
"156690178870054102966697089710863666198",
"97589094008776621651354770360189691565"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95",
"deprecated": false,
"target": {
"file": "include/haproxy/htx.h"
}
}
]