CVE-2023-25950: HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a…

PriorityP339high7.3CVSS 3.1

AVNACLPRNUINSUCLILAL

EPSS

2.94%

85.6th percentile

HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensitive information or cause a denial-of-service (DoS) condition.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
debian	haproxy	< haproxy 2.6.8-1 (bookworm)	haproxy 2.6.8-1 (bookworm)
haproxy	haproxy	—	—
haproxy	haproxy	>= 0 < 2.6.8-1	2.6.8-1
haproxy	haproxy	>= 0 < 2.6.8-1	2.6.8-1
haproxy	haproxy	>= 0 < 2.6.8-1	2.6.8-1
haproxy	haproxy	2.6.1 – 2.6.7	—
haproxy_technologies	haproxy	—	—

CVSS provenance

nvdv3.17.3HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

osv7.3HIGH

vendor_debian7.3HIGH

vendor_redhat7.3HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.