CVE-2021-40346

Description

An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.

Weakness classification

• nvd@nist.gov: CWE-190

Primary references

• cve@mitre.org — Patch, Vendor Advisory
• cve@mitre.org — Patch, Third Party Advisory
• cve@mitre.org — Exploit, Mitigation, Third Party Advisory
• cve@mitre.org
• cve@mitre.org
• cve@mitre.org
• cve@mitre.org
• cve@mitre.org — Third Party Advisory
• cve@mitre.org
• cve@mitre.org
• af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory