CVE-2021-40346
An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an...
Original description
The description as published by the source.
An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.
Affected packages
Bitnami
haproxy
[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.25"},{"introduced":"2.2.0"},{"fixed":"2.2.17"},{"introduced":"2.3.0"},{"fixed":"2.3.14"},{"introduced":"2.4.0"},{"fixed":"2.4.4"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2021-40346 haproxy Fixed in: 2.2.16-3
References
- advisory git.haproxy.org
- advisory github.com
- advisory jfrog.com
- advisory debian.org
- web lists.apache.org
- web lists.apache.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web mail-archive.com
- web mail-archive.com
- web nvd.nist.gov