BIT-haproxy-2023-40225

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/haproxy/BIT-haproxy-2023-40225.json

JSON Data

https://api.test.osv.dev/v1/vulns/BIT-haproxy-2023-40225

Aliases

CVE-2023-40225

Published

2024-03-06T10:53:12Z

Modified

2026-09-08T08:47:28Z

Summary

[none]

Details

HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.

Database specific

{
    "cpes": [
        "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
}

References

Affected packages

Bitnami / haproxy

Package

Name: haproxy
Purl: pkg:bitnami/haproxy

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.0.33

Introduced

2.2.0

Fixed

2.2.31

Introduced

2.4.0

Fixed

2.4.24

Introduced

2.5.0

Fixed

2.6.15

Introduced

2.7.0

Fixed

2.7.10

Introduced

2.8.0

Fixed

2.8.2

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/haproxy/BIT-haproxy-2023-40225.json"