HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.
References
| Link | Resource |
|---|---|
| https://cwe.mitre.org/data/definitions/436.html | Technical Description |
| https://github.com/haproxy/haproxy/commit/6492f1f29d738457ea9f382aca54537f35f9d856 | Patch |
| https://github.com/haproxy/haproxy/issues/2237 | Exploit Issue Tracking Vendor Advisory |
| https://www.haproxy.org/download/2.6/src/CHANGELOG | Release Notes |
| https://www.haproxy.org/download/2.7/src/CHANGELOG | Release Notes |
| https://www.haproxy.org/download/2.8/src/CHANGELOG | Release Notes |
| https://cwe.mitre.org/data/definitions/436.html | Technical Description |
| https://github.com/haproxy/haproxy/commit/6492f1f29d738457ea9f382aca54537f35f9d856 | Patch |
| https://github.com/haproxy/haproxy/issues/2237 | Exploit Issue Tracking Vendor Advisory |
| https://www.haproxy.org/download/2.6/src/CHANGELOG | Release Notes |
| https://www.haproxy.org/download/2.7/src/CHANGELOG | Release Notes |
| https://www.haproxy.org/download/2.8/src/CHANGELOG | Release Notes |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:19
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://cwe.mitre.org/data/definitions/436.html - Technical Description | |
| References | () https://github.com/haproxy/haproxy/commit/6492f1f29d738457ea9f382aca54537f35f9d856 - Patch | |
| References | () https://github.com/haproxy/haproxy/issues/2237 - Exploit, Issue Tracking, Vendor Advisory | |
| References | () https://www.haproxy.org/download/2.6/src/CHANGELOG - Release Notes | |
| References | () https://www.haproxy.org/download/2.7/src/CHANGELOG - Release Notes | |
| References | () https://www.haproxy.org/download/2.8/src/CHANGELOG - Release Notes |
18 Aug 2023, 20:03
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-444 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
| First Time |
Haproxy
Haproxy haproxy |
|
| References | (MISC) https://github.com/haproxy/haproxy/issues/2237 - Exploit, Issue Tracking, Vendor Advisory | |
| References | (MISC) https://www.haproxy.org/download/2.8/src/CHANGELOG - Release Notes | |
| References | (MISC) https://www.haproxy.org/download/2.6/src/CHANGELOG - Release Notes | |
| References | (MISC) https://github.com/haproxy/haproxy/commit/6492f1f29d738457ea9f382aca54537f35f9d856 - Patch | |
| References | (MISC) https://cwe.mitre.org/data/definitions/436.html - Technical Description | |
| References | (MISC) https://www.haproxy.org/download/2.7/src/CHANGELOG - Release Notes | |
| CPE | cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* |
10 Aug 2023, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-08-10 21:15
Updated : 2024-11-21 08:19
NVD link : CVE-2023-40225
Mitre link : CVE-2023-40225
CVE.ORG link : CVE-2023-40225
JSON object : View
Products Affected
haproxy
- haproxy
CWE
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')