CVE-2024-53008: Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy

Description

Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remote attacker may access a path that is restricted by ACL (Access Control List) set on the product. As a result, the attacker may obtain sensitive information.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

Low

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.0% · higher than 63% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

H2

HAProxy 2.6 · HAProxy Project

2.6.18 and earlier · source: vendor

H2

HAProxy 2.8 · HAProxy Project

2.8.10 and earlier · source: vendor

H2

HAProxy 2.9 · HAProxy Project

2.9.9 and earlier · source: vendor

H3

HAProxy 3.0 · HAProxy Project

3.0.2 and earlier · source: vendor

HA

Haproxy · Haproxy

2.6 through 2.6.18; 2.8 through 2.8.10; 2.9 through 2.9.9; 3.0 through 3.0.2 · source: CISA