{"id":"CVE-2019-18277","aliases":["CLSA-2026-1776336742","CLSA-2026-1776337242","DEBIAN-CVE-2019-18277","DLA-3034-1","EUVD-2019-8066","GHSA-7r84-r685-grmg","RHSA-2020:1287","RHSA-2020:1725","RHSA-2020:1936","RHSA-2020:2265","SUSE-SU-2019:3125-1","SUSE-SU-2019:3126-1","SUSE-SU-2019:3288-1","UBUNTU-CVE-2019-18277","USN-4174-1","openSUSE-SU-2019:2626-1","openSUSE-SU-2019:2645-1","openSUSE-SU-2024:10839-1"],"status":"published","title":"A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding...","description":"A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the \"chunked\" value were not being correctly rejected. The impact was limited but if combined with the \"http-reuse always\" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.10068,"percentile":0.95661,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2019-10-23T13:07:01Z","modified":"2026-11-02T02:45:25Z","fixes":[{"ecosystem":"TuxCare:OracleLinux:6","package":"haproxy","fixed_in":["1.5.18-1.el6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"haproxy","fixed_in":["1.5.18-1.el6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"haproxy","fixed_in":["2.0.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"haproxy","fixed_in":["2.0.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"haproxy","fixed_in":["2.0.6-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15","package":"haproxy","fixed_in":["2.0.10+git0.ac198b92-3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"haproxy","fixed_in":["2.0.10+git0.ac198b92-8.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"haproxy","fixed_in":["1.6.11-11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"haproxy","fixed_in":["1.6.11-11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"haproxy","fixed_in":["1.6.11-11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"haproxy","fixed_in":["1.6.11-11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"haproxy","fixed_in":["1.6.11-11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"haproxy","fixed_in":["1.6.11-11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP3","package":"haproxy","fixed_in":["1.6.11-11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP4","package":"haproxy","fixed_in":["1.6.11-11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP5","package":"haproxy","fixed_in":["1.6.11-11.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"haproxy","fixed_in":["1.6.3-1ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"haproxy","fixed_in":["1.8.8-1ubuntu0.7"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"haproxy","fixed_in":["2.0.10+git0.ac198b92-lp150.2.16.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"haproxy","fixed_in":["2.0.10+git0.ac198b92-lp151.2.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.18-1.el6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.18-1.el6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-2+deb9u1"}]}],"versions":["1.7.5-2"],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.23-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.23-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"haproxy18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.23-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.23-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.23-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.23-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el7","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.13-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el7","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.13-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el7","package":"haproxy20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.13-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.13-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el8","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.13-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el8","package":"haproxy20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.13-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el8","package":"haproxy20-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.13-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-haproxy18-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.24-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-haproxy18-haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.24-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-haproxy18-haproxy-syspaths","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.24-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10+git0.ac198b92-3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10+git0.ac198b92-8.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP5","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-11.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1ubuntu0.3"}]}],"versions":["1.5.14-1","1.5.15-1","1.6.2-1","1.6.2-2","1.6.2-2ubuntu1","1.6.2-2ubuntu3","1.6.3-1","1.6.3-1ubuntu0.1","1.6.3-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1ubuntu0.7"}]}],"versions":["1.7.9-1ubuntu1","1.7.9-1ubuntu2","1.8.4-1","1.8.7-1","1.8.8-1","1.8.8-1ubuntu0.1","1.8.8-1ubuntu0.2","1.8.8-1ubuntu0.3","1.8.8-1ubuntu0.4","1.8.8-1ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1ubuntu0.3"}]}],"versions":["1.5.14-1","1.5.15-1","1.6.2-1","1.6.2-2","1.6.2-2ubuntu1","1.6.2-2ubuntu3","1.6.3-1","1.6.3-1ubuntu0.1","1.6.3-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1ubuntu0.7"}]}],"versions":["1.7.9-1ubuntu1","1.7.9-1ubuntu2","1.8.4-1","1.8.7-1","1.8.8-1","1.8.8-1ubuntu0.1","1.8.8-1ubuntu0.2","1.8.8-1ubuntu0.3","1.8.8-1ubuntu0.4","1.8.8-1ubuntu0.6"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10+git0.ac198b92-lp150.2.16.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10+git0.ac198b92-lp151.2.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4+git0.acb1d0bea-1.2"}]}],"bundled":9}],"products":[{"vendor":"haproxy","product":"haproxy"}],"references":[{"url":"https://www.mail-archive.com/haproxy%40formilux.org/msg34926.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nathandavison.com/blog/haproxy-http-request-smuggling","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://git.haproxy.org/?p=haproxy-2.0.git%3Ba=commit%3Bh=196a7df44d8129d1adc795da020b722614d6a581","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4174-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00016.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00019.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00045.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18277","tags":["advisory"]},{"url":"https://git.haproxy.org/?p=haproxy-2.0.git;a=commit;h=196a7df44d8129d1adc795da020b722614d6a581"},{"url":"https://www.mail-archive.com/haproxy@formilux.org/msg34926.html","tags":["report"]},{"url":"https://github.com/advisories/GHSA-7r84-r685-grmg"},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1776336742.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1776337242.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-18277","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1287","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1759697","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1777584","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1819111","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1287.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-18277","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-18277","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-19330","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-19330","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19330","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-11100","tags":["report"]},{"url":"https://access.redhat.com/security/vulnerabilities/haproxy","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11100","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11100","tags":["advisory"]},{"url":"https://bugs.chromium.org/p/project-zero/issues/detail?id=2023","tags":["article"]},{"url":"https://www.haproxy.com/blog/haproxy-1-8-http-2-hpack-decoder-vulnerability-fixed/","tags":["article"]},{"url":"https://www.mail-archive.com/haproxy@formilux.org/msg36876.html","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1725","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.2_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1774745","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1778844","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1725.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1936","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1936.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2265","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_software_collections/3/html/3.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1774747","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2265.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193125-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1082318","tags":["report"]},{"url":"https://bugzilla.suse.com/1154980","tags":["report"]},{"url":"https://bugzilla.suse.com/1157712","tags":["report"]},{"url":"https://bugzilla.suse.com/1157714","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18277","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193126-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193288-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-18277","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4174-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LRO3KI4YJZBWE64ZPPA3RDDRRA2XUQDO/#LRO3KI4YJZBWE64ZPPA3RDDRRA2XUQDO","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PP5FNHGIQNR62XF35XBXZBJVFS2DJOAZ/#PP5FNHGIQNR62XF35XBXZBJVFS2DJOAZ","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-40346","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-18277","description":"A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the \"chunked\" value were not being correctly rejected. The impact was limited but if combined with the \"http-reuse always\" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).","status":"published","published":"2019-10-23T13:07:01Z","modified":"2024-08-05T01:47:14.151Z","updated_at":"2026-11-02T14:32:23.803059Z"}],"euvd":[{"id":"EUVD-2019-8066","description":"A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the \"chunked\" value were not being correctly rejected. The impact was limited but if combined with the \"http-reuse always\" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).","status":"published","published":"2019-10-23T13:07:01Z","modified":"2024-08-05T01:47:14Z","updated_at":"2026-11-03T02:40:28.860423Z"}],"ghsa":[{"id":"GHSA-7r84-r685-grmg","title":"A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding...","description":"A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the \"chunked\" value were not being correctly rejected. The impact was limited but if combined with the \"http-reuse always\" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).","status":"published","published":"2022-05-24T16:59:39Z","modified":"2023-01-28T05:07:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:44:32.070856Z"}],"nvd":[{"id":"CVE-2019-18277","description":"A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the \"chunked\" value were not being correctly rejected. The impact was limited but if combined with the \"http-reuse always\" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).","status":"published","published":"2019-10-23T14:15:10.557Z","modified":"2026-06-17T02:24:44.453Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:05:32.982925Z"}],"osv":[{"id":"CVE-2019-18277","description":"A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the \"chunked\" value were not being correctly rejected. The impact was limited but if combined with the \"http-reuse always\" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).","status":"published","published":"2019-10-23T14:15:10.557Z","modified":"2026-11-02T02:45:25.359886406Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-18277","description":"A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the \"chunked\" value were not being correctly rejected. The impact was limited but if combined with the \"http-reuse always\" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).","status":"published","published":"2019-10-23T14:15:10.557Z","modified":"2026-09-21T07:03:10.106732679Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"RHSA-2020:1287","title":"Red Hat Security Advisory: OpenShift Container Platform 3.11 security update","status":"published","published":"2024-09-13T22:02:49Z","modified":"2026-06-28T10:35:41Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:1725","title":"Red Hat Security Advisory: haproxy security, bug fix, and enhancement update","status":"published","published":"2024-09-13T16:17:55Z","modified":"2026-06-29T10:29:51Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:1936","title":"Red Hat Security Advisory: OpenShift Container Platform 4.4.3 haproxy security update","status":"published","published":"2024-09-13T22:03:52Z","modified":"2026-06-28T10:36:29Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2265","title":"Red Hat Security Advisory: rh-haproxy18-haproxy security, bug fix, and enhancement update","status":"published","published":"2024-09-13T16:18:59Z","modified":"2026-06-29T10:30:25Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"UBUNTU-CVE-2019-18277","description":"A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the \"chunked\" value were not being correctly rejected. The impact was limited but if combined with the \"http-reuse always\" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).","status":"published","published":"2019-10-23T14:15:00Z","modified":"2026-02-04T04:07:35.096419Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"CLSA-2026-1776336742","title":"haproxy: Fix of CVE-2019-18277","description":"- CVE-2019-18277: reject messages where \"chunked\" is missing\n  from transfer-encoding","status":"published","published":"2026-04-16T10:52:29Z","modified":"2026-06-01T00:32:20.298493018Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1776337242","title":"haproxy: Fix of CVE-2019-18277","description":"- CVE-2019-18277: reject messages where \"chunked\" is missing\n  from transfer-encoding","status":"published","published":"2026-04-16T14:45:52Z","modified":"2026-06-01T00:33:03.685064875Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"DLA-3034-1","title":"haproxy - security update","status":"published","published":"2022-05-30T00:00:00Z","modified":"2026-03-09T01:21:29.239625Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"openSUSE-SU-2019:2626-1","title":"Security update for haproxy","description":"This update for haproxy to version 2.0.10 fixes the following issues:\n\nHAProxy was updated to 2.0.10 \t  \n\nSecurity issues fixed:\n\n- CVE-2019-18277: Fixed a potential HTTP smuggling in messages \n  with transfer-encoding header missing the 'chunked' (bsc#1154980).\n- Fixed an improper handling of headers which could have led to \n  injecting LFs in H2-to-H1 transfers creating new attack space (bsc#1157712)\n- Fixed an issue where HEADER frames in idle streams are not rejected and    \n  thus trying to decode them HAPrpxy crashes (bsc#1157714).\n\nOther issue addressed:   \n\n- Macro change in the spec file (bsc#1082318)\n\nMore information regarding the release at: \nhttp://git.haproxy.org/?p=haproxy-2.0.git;a=commit;h=ac198b92d461515551b95daae20954b3053ce87e\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-12-03T14:49:39Z","modified":"2026-02-04T02:43:17.03087Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2019:2645-1","title":"Security update for haproxy","description":"This update for haproxy to version 2.0.10 fixes the following issues:\n\nHAProxy was updated to 2.0.10 \t  \n\nSecurity issues fixed:\n\n- CVE-2019-18277: Fixed a potential HTTP smuggling in messages \n  with transfer-encoding header missing the 'chunked' (bsc#1154980).\n- Fixed an improper handling of headers which could have led to \n  injecting LFs in H2-to-H1 transfers creating new attack space (bsc#1157712)\n- Fixed an issue where HEADER frames in idle streams are not rejected and    \n  thus trying to decode them HAPrpxy crashes (bsc#1157714).\n\nOther issue addressed:   \n\n- Macro change in the spec file (bsc#1082318)\n\nMore information regarding the release at: \nhttp://git.haproxy.org/?p=haproxy-2.0.git;a=commit;h=ac198b92d461515551b95daae20954b3053ce87e\t  \n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2019-12-04T19:14:22Z","modified":"2025-05-07T18:10:53.916013Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10839-1","title":"haproxy-2.4.4+git0.acb1d0bea-1.2 on GA media","description":"These are all security issues fixed in the haproxy-2.4.4+git0.acb1d0bea-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:00:47.357107Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:3125-1","title":"Security update for haproxy","description":"This update for haproxy to version 2.0.10 fixes the following issues:\n\nHAProxy was updated to 2.0.10 \t  \n\nSecurity issues fixed:\n\n- CVE-2019-18277: Fixed a potential HTTP smuggling in messages \n  with transfer-encoding header missing the 'chunked' (bsc#1154980).\n- Fixed an improper handling of headers which could have led to \n  injecting LFs in H2-to-H1 transfers creating new attack space (bsc#1157712)\n- Fixed an issue where HEADER frames in idle streams are not rejected and    \n  thus trying to decode them HAPrpxy crashes (bsc#1157714).\n\nOther issue addressed:   \n\n- Macro change in the spec file (bsc#1082318)\n\nMore information regarding the release at: \nhttp://git.haproxy.org/?p=haproxy-2.0.git;a=commit;h=ac198b92d461515551b95daae20954b3053ce87e\n","status":"published","published":"2019-11-29T16:21:08Z","modified":"2026-02-04T03:49:52.851539Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2019:3126-1","title":"Security update for haproxy","description":"This update for haproxy to version 2.0.10 fixes the following issues:\n\nHAProxy was updated to 2.0.10 \t  \n\nSecurity issues fixed:\n\n- CVE-2019-18277: Fixed a potential HTTP smuggling in messages \n  with transfer-encoding header missing the 'chunked' (bsc#1154980).\n- Fixed an improper handling of headers which could have led to \n  injecting LFs in H2-to-H1 transfers creating new attack space (bsc#1157712)\n- Fixed an issue where HEADER frames in idle streams are not rejected and    \n  thus trying to decode them HAPrpxy crashes (bsc#1157714).\n\nOther issue addressed:   \n\n- Macro change in the spec file (bsc#1082318)\n\nMore information regarding the release at: \nhttp://git.haproxy.org/?p=haproxy-2.0.git;a=commit;h=ac198b92d461515551b95daae20954b3053ce87e\t  \n","status":"published","published":"2019-11-29T16:21:26Z","modified":"2026-02-04T02:55:32.727949Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2019:3288-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\n- CVE-2019-18277: Fixed HTTP smuggling in messages with transfer-encoding header missing the 'chunked' value (bsc#1154980).\n","status":"published","published":"2019-12-12T14:52:10Z","modified":"2026-02-04T02:15:41.312281Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"USN-4174-1","title":"haproxy vulnerability","description":"It was discovered that HAproxy incorrectly handled certain HTTP requests.\nAn attacker could possibly use this issue to a privilege escalation\n(Request Smuggling).\n","status":"published","published":"2019-11-05T12:50:26Z","modified":"2026-02-10T04:41:40Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}