CVE-2021-40346 — Integer Overflow or Wraparound in Haproxy

CWE-190 — Integer Overflow or WraparoundCWE-444 — HTTP Request Smuggling8 documents8 sources
Severity
7.5HIGHNVD
EPSS
92.4%
top 0.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
HaproxyDebian HaproxyDebian Linux+1 more
Timeline
PublishedSep 8
Latest updateJan 11

Description

An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/haproxy< haproxy 2.2.16-3 (bookworm)
▶NVDhaproxy/haproxy2.0.0 — 2.0.25+4
▶Debianhaproxy/haproxy< 2.2.9-2+deb11u2+3

Also affects: Debian Linux 11.0, Fedora 33, 34

Patches

Patch: git.haproxy.org ↗Patch: github.com ↗Patch: git.haproxy.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-jwmg-q4wv-f75h: An integer overflow exists in HAProxy 2↗2022-05-24
▶
OSV
CVE-2021-40346: An integer overflow exists in HAProxy 2↗2021-09-08
▶

📋Vendor Advisories

3
Red Hat
haproxy: request smuggling attack or response splitting via duplicate content-length header↗2021-09-08
▶
Ubuntu
HAProxy vulnerabilities↗2021-09-08
▶
Debian
CVE-2021-40346: haproxy - An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can...↗2021
▶

📄Research Papers

2
arXiv
Securing an Application Layer Gateway: An Industrial Case Study↗2024-01-11
▶
CTF
2021_IntentCTF / Door_(un)Locked↗2021
▶