High severity · published Aug 10, 2023
CVE-2023-40225
HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty…
7.2
CVSS
2.1%
EPSS
No
On KEV
Description
HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
Haproxy · Haproxy
through 2.0.32; 2.2.0 through 2.2.30; 2.4.0 through 2.4.23; 2.5.0 before 2.6.15; 2.7.0 before 2.7.10; 2.8.0 before 2.8.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-40225
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-40225
Technical Description
https://cwe.mitre.org/data/definitions/436.html
Patch
https://github.com/haproxy/haproxy/commit/6492f1f29d738457ea9f382aca54537f35f9d856
Exploit
https://github.com/haproxy/haproxy/issues/2237
Release Notes
https://www.haproxy.org/download/2.6/src/CHANGELOG
Release Notes
https://www.haproxy.org/download/2.7/src/CHANGELOG
Release Notes
https://www.haproxy.org/download/2.8/src/CHANGELOG
More from Haproxy
9.8
CVE-2019-19330
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL,…
9.1
CVE-2026-55203
HAProxy - Integer Overflow in FCGI Demux Record Length Field
9.1
CVE-2023-25725
HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in…
8.8
CVE-2020-11100
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap…
8.2
CVE-2023-45539
HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon…