{"id":"CVE-2021-40346","aliases":["BIT-haproxy-2021-40346","DEBIAN-CVE-2021-40346","DSA-4968-1","EUVD-2021-27525","GHSA-jwmg-q4wv-f75h","OESA-2021-1367","RHSA-2021:4118","RHSA-2021:5208","RHSA-2022:0024","RHSA-2022:0114","SUSE-SU-2021:2975-1","SUSE-SU-2021:3257-1","SUSE-SU-2021:3258-1","UBUNTU-CVE-2021-40346","USN-5063-1","openSUSE-SU-2021:1329-1","openSUSE-SU-2021:2975-1","openSUSE-SU-2024:10839-1"],"status":"published","title":"An integer overflow exists in HAProxy 2.0 through 2.5 in the htx_add_header() can be exploited to...","description":"An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.58832,"percentile":0.99116,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-190"],"published":"2021-09-07T00:00:00Z","modified":"2026-11-02T07:26:41Z","exploits":[{"source":"pocgithub","id":"knqyf263/CVE-2021-40346","title":"knqyf263/CVE-2021-40346","date":"2021-09-08","url":"https://github.com/knqyf263/CVE-2021-40346"},{"source":"pocgithub","id":"alikarimi999/CVE-2021-40346","title":"alikarimi999/CVE-2021-40346","date":"2021-09-10","url":"https://github.com/alikarimi999/CVE-2021-40346"},{"source":"pocgithub","id":"donky16/CVE-2021-40346-POC","title":"donky16/CVE-2021-40346-POC","date":"2021-09-10","url":"https://github.com/donky16/CVE-2021-40346-POC"},{"source":"pocgithub","id":"Vulnmachines/HAProxy_CVE-2021-40346","title":"Vulnmachines/HAProxy_CVE-2021-40346","date":"2021-11-08","url":"https://github.com/Vulnmachines/HAProxy_CVE-2021-40346"},{"source":"pocgithub","id":"alexOarga/CVE-2021-40346","title":"alexOarga/CVE-2021-40346","date":"2022-01-24","url":"https://github.com/alexOarga/CVE-2021-40346"},{"source":"pocgithub","id":"BoianEduard/CVE-2021-40346","title":"BoianEduard/CVE-2021-40346","date":"2025-12-21","url":"https://github.com/BoianEduard/CVE-2021-40346"},{"source":"pocgithub","id":"jmg0929/CVE-2021-40346","title":"jmg0929/CVE-2021-40346","date":"2026-07-08","url":"https://github.com/jmg0929/CVE-2021-40346"}],"fixes":[{"ecosystem":"Bitnami","package":"haproxy","fixed_in":["2.0.25","2.2.17","2.3.14","2.4.4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"haproxy","fixed_in":["2.2.16-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"haproxy","fixed_in":["2.2.16-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"haproxy","fixed_in":["2.2.16-3"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"haproxy","fixed_in":["2.2.9-2+deb11u2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"haproxy","fixed_in":["2.2.16-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"haproxy","fixed_in":["2.2.16-2.oe1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"haproxy","fixed_in":["2.0.14-11.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"haproxy","fixed_in":["2.0.14-11.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"haproxy","fixed_in":["2.0.14-8.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15","package":"haproxy","fixed_in":["2.0.14-3.31.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"haproxy","fixed_in":["2.0.13-2ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"haproxy","fixed_in":["2.2.9-2ubuntu2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"haproxy","fixed_in":["2.0.14-lp152.2.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"haproxy","fixed_in":["2.0.14-11.11.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"haproxy","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.25"},{"introduced":"2.2.0"},{"fixed":"2.2.17"},{"introduced":"2.3.0"},{"fixed":"2.3.14"},{"introduced":"2.4.0"},{"fixed":"2.4.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-3"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-2+deb11u2"}]}],"versions":["2.2.9-2","2.2.9-2+deb11u1","2.2.9-2+deb11u1~bpo10+1","2.2.9-2+deb11u2~bpo10+1"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-2.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-2.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-2.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el7","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.13-2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el7","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.13-2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.13-2.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.13-2.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el7","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.16-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el7","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.16-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el7","package":"haproxy20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.16-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.16-4.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.16-4.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"haproxy20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.16-4.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"haproxy20-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.16-4.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"haproxy20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-2.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-2.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"haproxy20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-2.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"haproxy20-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-2.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-11.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-11.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-8.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.31.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.13-2ubuntu0.3"}]}],"versions":["2.0.5-1","2.0.8-1","2.0.9-1","2.0.10-1","2.0.10-1ubuntu1","2.0.11-1ubuntu1","2.0.12-1ubuntu2","2.0.13-1ubuntu2","2.0.13-2","2.0.13-2ubuntu0.1","2.0.13-2ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-2ubuntu2"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.13-2ubuntu0.3"}]}],"versions":["2.0.5-1","2.0.8-1","2.0.9-1","2.0.10-1","2.0.10-1ubuntu1","2.0.11-1ubuntu1","2.0.12-1ubuntu2","2.0.13-1ubuntu2","2.0.13-2","2.0.13-2ubuntu0.1","2.0.13-2ubuntu0.2"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-lp152.2.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-11.11.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4+git0.acb1d0bea-1.2"}]}],"bundled":9}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"haproxy","product":"haproxy"}],"references":[{"url":"https://www.mail-archive.com/haproxy%40formilux.org","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://git.haproxy.org/?p=haproxy.git","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"https://www.debian.org/security/2021/dsa-4968","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.mail-archive.com/haproxy%40formilux.org/msg41114.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://jfrog.com/blog/critical-vulnerability-in-haproxy-cve-2021-40346-integer-overflow-enables-http-smuggling/","tags":["x_refsource_MISC","x_transferred","Exploit","Mitigation","Third Party Advisory","advisory","evidence"]},{"url":"https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://lists.apache.org/thread.html/r284567dd7523f5823e2ce995f787ccd37b1cc4108779c50a97c79120%40%3Cdev.cloudstack.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r8a58fd7a29808e5d27ee56877745e58dc4bb041b9af94601554e2a5a%40%3Cdev.cloudstack.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7V2IYO22LWVBGUNZWVKNTMDV4KINLFO/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXTSBY2TEAXWZVFQM3CXHJFRONX7PEMN/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40346","tags":["web","advisory"]},{"url":"https://lists.apache.org/thread.html/r284567dd7523f5823e2ce995f787ccd37b1cc4108779c50a97c79120@%3Cdev.cloudstack.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r8a58fd7a29808e5d27ee56877745e58dc4bb041b9af94601554e2a5a@%3Cdev.cloudstack.apache.org%3E"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A7V2IYO22LWVBGUNZWVKNTMDV4KINLFO/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MXTSBY2TEAXWZVFQM3CXHJFRONX7PEMN/"},{"url":"https://www.mail-archive.com/haproxy@formilux.org"},{"url":"https://www.mail-archive.com/haproxy@formilux.org/msg41114.html","tags":["report"]},{"url":"https://github.com/advisories/GHSA-jwmg-q4wv-f75h"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-40346","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1367","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4118","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1995104","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1995107","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1995112","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000599","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4118.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-39240","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-39240","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39240","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-39241","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-39241","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39241","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-39242","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-39242","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39242","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-40346","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-40346","tags":["advisory","report"]},{"url":"https://www.haproxy.org/download/2.4/src/CHANGELOG","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:5208","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2002703","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2021_5208.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0024","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037401","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0024.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0114","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0114.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212975-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1189877","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-40346","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213257-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213258-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-40346","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5063-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VUBHGD7IXTYDS4PM3AVFQLIU2HR2Y24Y/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/Z6TTUW6SSY2VZZGE3CPYLSNSIBVPT2RR/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39240","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-40346","description":"An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.","status":"published","published":"2021-09-08T16:40:38Z","modified":"2024-08-04T02:27:31.887Z","updated_at":"2026-11-02T14:33:01.852999Z"}],"euvd":[{"id":"EUVD-2021-27525","description":"An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.","status":"published","published":"2021-09-08T16:40:38Z","modified":"2024-08-04T02:27:31Z","updated_at":"2026-11-03T03:24:20.862157Z"}],"ghsa":[{"id":"GHSA-jwmg-q4wv-f75h","title":"An integer overflow exists in HAProxy 2.0 through 2.5 in the htx_add_header() can be exploited to...","description":"An integer overflow exists in HAProxy 2.0 through 2.5 in the htx_add_header() can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.","status":"published","published":"2022-05-24T19:13:19Z","modified":"2023-01-30T05:01:57Z","cwes":["CWE-190"],"updated_at":"2026-11-02T14:46:31.662536Z"}],"nvd":[{"id":"CVE-2021-40346","description":"An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.","status":"published","published":"2021-09-08T17:15:12.457Z","modified":"2026-06-17T04:06:46.193Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:06:58.502206Z"}],"osv":[{"id":"CVE-2021-40346","description":"An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.","status":"published","published":"2021-09-08T17:15:12.457Z","modified":"2026-11-02T07:26:41.6219282Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:21.249056Z"},{"id":"DEBIAN-CVE-2021-40346","description":"An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.","status":"published","published":"2021-09-08T17:15:12.457Z","modified":"2026-10-23T18:03:32.793804231Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"OESA-2021-1367","title":"haproxy security update","description":"HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.\r\n\r\nSecurity Fix(es):\r\n\r\nAn integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.(CVE-2021-40346)","status":"published","published":"2021-09-30T11:04:38Z","modified":"2026-08-18T01:16:02.022094106Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:4118","title":"Red Hat Security Advisory: OpenShift Container Platform 4.9.6 packages and security update","status":"published","published":"2024-09-16T06:48:23Z","modified":"2025-11-22T12:26:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:5208","title":"Red Hat Security Advisory: OpenShift Container Platform 4.8.25 security update","status":"published","published":"2024-09-16T06:48:30Z","modified":"2025-12-18T10:32:46.121017Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0024","title":"Red Hat Security Advisory: OpenShift Container Platform 4.6.53 security update","status":"published","published":"2024-09-16T06:48:37Z","modified":"2025-11-22T12:28:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0114","title":"Red Hat Security Advisory: OpenShift Container Platform 4.7.41 security update","status":"published","published":"2024-09-16T06:48:45Z","modified":"2025-11-22T12:29:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"UBUNTU-CVE-2021-40346","description":"An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.","status":"published","published":"2021-09-07T15:00:00Z","modified":"2026-02-04T04:27:35.652527Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:28.526929Z"},{"id":"BIT-haproxy-2021-40346","description":"An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.","status":"published","published":"2024-03-06T10:54:15.896Z","modified":"2026-09-08T08:47:52.098476086Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"DSA-4968-1","title":"haproxy - security update","status":"published","published":"2021-09-07T00:00:00Z","modified":"2026-03-09T02:10:23.345899Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2021:1329-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\n- CVE-2021-40346: Fixed request smuggling vulnerability in HTX (bsc#1189877).\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2021-10-03T04:32:12Z","modified":"2026-02-04T03:29:13.059586Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:2975-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\n- CVE-2021-40346: Fixed request smuggling vulnerability in HTX (bsc#1189877).\n","status":"published","published":"2021-09-07T19:08:42Z","modified":"2026-02-04T03:54:44.188506Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:10839-1","title":"haproxy-2.4.4+git0.acb1d0bea-1.2 on GA media","description":"These are all security issues fixed in the haproxy-2.4.4+git0.acb1d0bea-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:00:47.357107Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2021:2975-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\n- CVE-2021-40346: Fixed request smuggling vulnerability in HTX (bsc#1189877).\n","status":"published","published":"2021-09-07T19:08:41Z","modified":"2026-02-04T03:51:54.826246Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3257-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\n- CVE-2021-40346: Fixed request smuggling vulnerability in HTX (bsc#1189877).\n","status":"published","published":"2021-09-29T14:31:49Z","modified":"2026-02-04T02:55:27.365693Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3258-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\n- CVE-2021-40346: Fixed request smuggling vulnerability in HTX (bsc#1189877).\n","status":"published","published":"2021-09-29T14:32:04Z","modified":"2026-02-04T03:23:20.053145Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"USN-5063-1","title":"haproxy vulnerabilities","description":"Ori Hollander discovered that HAProxy incorrectly handled HTTP header name\nlength encoding. A remote attacker could possibly use this issue to inject\na duplicate content-length header and perform request smuggling attacks.\n","status":"published","published":"2021-09-08T11:06:21Z","modified":"2026-02-10T04:42:18Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}