{"id":"CVE-2021-39240","aliases":["BIT-haproxy-2021-39240","DEBIAN-CVE-2021-39240","DSA-4960-1","EUVD-2021-25602","GHSA-88gq-424p-x3xc","OESA-2021-1333","RHSA-2021:4118","RHSA-2021:5208","openSUSE-SU-2024:10839-1"],"status":"published","title":"An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It...","description":"An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0221,"percentile":0.82827,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2021-08-17T00:00:00Z","modified":"2026-11-02T02:46:06Z","fixes":[{"ecosystem":"Bitnami","package":"haproxy","fixed_in":["2.2.16","2.3.13","2.4.3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"haproxy","fixed_in":["2.2.16-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"haproxy","fixed_in":["2.2.16-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"haproxy","fixed_in":["2.2.16-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"haproxy","ranges":[{"type":"SEMVER","events":[{"introduced":"2.2.0"},{"fixed":"2.2.16"},{"introduced":"2.3.0"},{"fixed":"2.3.13"},{"introduced":"2.4.0"},{"fixed":"2.4.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-2+deb11u1"}]}],"versions":["2.2.9-2","2.2.9-2+deb11u1~bpo10+1"],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-1.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-1.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-2.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-2.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el7","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.13-2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el7","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.13-2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.13-2.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.13-2.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4+git0.acb1d0bea-1.2"}]}],"bundled":9}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"haproxy","product":"haproxy"}],"references":[{"url":"https://www.mail-archive.com/haproxy%40formilux.org/msg41041.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=a495e0d94876c9d39763db319f609351907a31e8","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=4b8852c70d8c4b7e225e24eb58258a15eb54c26e","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.debian.org/security/2021/dsa-4960","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RPNY4WZIQUAUOCLIMUPC37AQWNXTWIQM/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ALECUZDIMT5FYGP6V6PVSI4BKVZTZWN/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39240","tags":["web","advisory"]},{"url":"https://git.haproxy.org/?p=haproxy.git;a=commit;h=4b8852c70d8c4b7e225e24eb58258a15eb54c26e"},{"url":"https://git.haproxy.org/?p=haproxy.git;a=commit;h=a495e0d94876c9d39763db319f609351907a31e8"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ALECUZDIMT5FYGP6V6PVSI4BKVZTZWN/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RPNY4WZIQUAUOCLIMUPC37AQWNXTWIQM/"},{"url":"https://www.mail-archive.com/haproxy@formilux.org/msg41041.html"},{"url":"https://github.com/advisories/GHSA-88gq-424p-x3xc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-39240","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1333","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39241","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39242","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4118","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1995104","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1995107","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1995112","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000599","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4118.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-39240","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-39240","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-39241","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-39241","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-39242","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-39242","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-40346","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-40346","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40346","tags":["advisory"]},{"url":"https://www.haproxy.org/download/2.4/src/CHANGELOG","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:5208","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2002703","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2021_5208.json","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-40346","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-39240","description":"An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve.","status":"published","published":"2021-08-17T18:33:25Z","modified":"2024-08-04T02:06:40.823Z","updated_at":"2026-11-02T14:33:09.540052Z"}],"euvd":[{"id":"EUVD-2021-25602","description":"An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve.","status":"published","published":"2021-08-17T18:33:25Z","modified":"2024-08-04T02:06:40Z","updated_at":"2026-11-03T03:24:23.719378Z"}],"ghsa":[{"id":"GHSA-88gq-424p-x3xc","title":"An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It...","description":"An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve.","status":"published","published":"2022-05-24T19:11:22Z","modified":"2023-01-30T05:01:35Z","updated_at":"2026-11-02T14:46:26.483285Z"}],"nvd":[{"id":"CVE-2021-39240","description":"An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve.","status":"published","published":"2021-08-17T19:15:08.247Z","modified":"2026-06-17T04:03:22.87Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:57.318236Z"}],"osv":[{"id":"CVE-2021-39240","description":"An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve.","status":"published","published":"2021-08-17T19:15:08.247Z","modified":"2026-11-02T02:46:06.607280524Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:20.843843Z"},{"id":"DEBIAN-CVE-2021-39240","description":"An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve.","status":"published","published":"2021-08-17T19:15:08.247Z","modified":"2026-10-23T18:03:32.078570716Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"OESA-2021-1333","title":"haproxy security update","description":"HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world\u0026apos;s most visited ones.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve.(CVE-2021-39240)\r\n\r\nAn issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. An HTTP method name may contain a space followed by the name of a protected resource. It is possible that a server would interpret this as a request for that protected resource, such as in the \u0026quot;GET /admin? HTTP/1.1 /static/images HTTP/1.1\u0026quot; example.(CVE-2021-39241)\r\n\r\nAn issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead to a situation with an attacker-controlled HTTP Host header, because a mismatch between Host and authority is mishandled.(CVE-2021-39242)","status":"published","published":"2021-09-03T11:04:36Z","modified":"2026-08-18T01:15:36.494232697Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:4118","title":"Red Hat Security Advisory: OpenShift Container Platform 4.9.6 packages and security update","status":"published","published":"2024-09-16T06:48:23Z","modified":"2025-11-22T12:26:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:5208","title":"Red Hat Security Advisory: OpenShift Container Platform 4.8.25 security update","status":"published","published":"2024-09-16T06:48:30Z","modified":"2025-12-18T10:32:46.121017Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"BIT-haproxy-2021-39240","description":"An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve.","status":"published","published":"2024-03-06T10:54:54.3Z","modified":"2026-09-08T08:47:52.254666394Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"DSA-4960-1","title":"haproxy - security update","status":"published","published":"2021-08-17T00:00:00Z","modified":"2026-03-09T02:10:48.713652Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2024:10839-1","title":"haproxy-2.4.4+git0.acb1d0bea-1.2 on GA media","description":"These are all security issues fixed in the haproxy-2.4.4+git0.acb1d0bea-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:00:47.357107Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}