{"id":"CVE-2023-40225","aliases":["ALSA-2024:1142","AZL-27912","BIT-haproxy-2023-40225","CLSA-2025-1736503350","DEBIAN-CVE-2023-40225","DSA-5590-1","EUVD-2023-44822","GHSA-xgq7-jp95-v2qv","MGASA-2023-0320","OESA-2023-1541","RHSA-2023:7473","RHSA-2023:7606","RHSA-2024:0200","RHSA-2024:0308","RHSA-2024:1089","RHSA-2024:1142","SUSE-SU-2023:3469-1","SUSE-SU-2023:3490-1","SUSE-SU-2023:4646-1","UBUNTU-CVE-2023-40225","USN-6294-1","USN-6294-2","openSUSE-SU-2024:13116-1"],"status":"published","title":"HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and...","description":"HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02147,"percentile":0.82256,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2023-08-10T00:00:00Z","modified":"2026-11-02T13:15:24Z","fixes":[{"ecosystem":"Azure Linux:2","package":"haproxy","fixed_in":["2.4.24-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"haproxy","fixed_in":["2.0.33","2.2.31","2.4.24","2.6.15","2.7.10","2.8.2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"haproxy","fixed_in":["2.4.17-6.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"haproxy","fixed_in":["2.6.12-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"haproxy","fixed_in":["2.6.15-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"haproxy","fixed_in":["2.6.15-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"haproxy","fixed_in":["2.8.3-9.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"haproxy","fixed_in":["2.2.16-5.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"haproxy","fixed_in":["2.2.16-5.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"haproxy","fixed_in":["2.6.6-4.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"haproxy","fixed_in":["2.6.6-4.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"haproxy","fixed_in":["2.6.6-4.oe2203sp2"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.13::el8","package":"haproxy","fixed_in":["0:2.2.24-4.rhaos4.13.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.13::el8","package":"haproxy-debugsource","fixed_in":["0:2.2.24-4.rhaos4.13.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.13::el8","package":"haproxy22","fixed_in":["0:2.2.24-4.rhaos4.13.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.13::el8","package":"haproxy22-debuginfo","fixed_in":["0:2.2.24-4.rhaos4.13.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.12::el8","package":"haproxy","fixed_in":["0:2.2.24-4.rhaos4.12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.12::el8","package":"haproxy-debugsource","fixed_in":["0:2.2.24-4.rhaos4.12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.12::el8","package":"haproxy22","fixed_in":["0:2.2.24-4.rhaos4.12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.12::el8","package":"haproxy22-debuginfo","fixed_in":["0:2.2.24-4.rhaos4.12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.11::el8","package":"haproxy","fixed_in":["0:2.2.24-4.rhaos4.11.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.11::el8","package":"haproxy-debugsource","fixed_in":["0:2.2.24-4.rhaos4.11.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.11::el8","package":"haproxy22","fixed_in":["0:2.2.24-4.rhaos4.11.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.11::el8","package":"haproxy22-debuginfo","fixed_in":["0:2.2.24-4.rhaos4.11.el8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"haproxy","fixed_in":["2.4.22+git0.f8e3218e2-150400.3.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"haproxy","fixed_in":["2.4.22+git0.f8e3218e2-150400.3.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"haproxy","fixed_in":["2.4.22+git0.f8e3218e2-150400.3.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP5","package":"haproxy","fixed_in":["2.4.22+git0.f8e3218e2-150400.3.16.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"haproxy","fixed_in":["2.4.22+git0.f8e3218e2-150400.3.16.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.4","package":"haproxy","fixed_in":["2.4.22+git0.f8e3218e2-150400.3.16.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"haproxy","fixed_in":["2.4.22+git0.f8e3218e2-150400.3.16.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"haproxy","fixed_in":["2.4.22+git0.f8e3218e2-150400.3.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"haproxy","fixed_in":["2.0.31-150200.11.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"haproxy","fixed_in":["2.0.31-150200.11.23.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"haproxy","fixed_in":["2.0.31-0ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"haproxy","fixed_in":["2.4.22-0ubuntu0.22.04.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"haproxy","fixed_in":["2.8.2+git0.61a0f576a-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22-3.el9_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.24-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"haproxy","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.33"},{"introduced":"2.2.0"},{"fixed":"2.2.31"},{"introduced":"2.4.0"},{"fixed":"2.4.24"},{"introduced":"2.5.0"},{"fixed":"2.6.15"},{"introduced":"2.7.0"},{"fixed":"2.7.10"},{"introduced":"2.8.0"},{"fixed":"2.8.2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17-6.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.12-1+deb12u1"}]}],"versions":["2.6.12-1"]},{"source":"osv","ecosystem":"Debian:13","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.15-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.15-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-2+deb11u6"}]}],"versions":["2.2.9-2","2.2.9-2+deb11u1","2.2.9-2+deb11u1~bpo10+1","2.2.9-2+deb11u2","2.2.9-2+deb11u2~bpo10+1","2.2.9-2+deb11u3","2.2.9-2+deb11u3~bpo10+1","2.2.9-2+deb11u4","2.2.9-2+deb11u5"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.12-1+deb12u1"}]}],"versions":["2.6.12-1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.3-9.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-5.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-5.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-4.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-4.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-4.oe2203sp2"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.14::el9","package":"python-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.3-2.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.14::el9","package":"python3-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.3-2.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.13-2.rhaos4.14.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.13-2.rhaos4.14.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"haproxy26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.13-2.rhaos4.14.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"haproxy26-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.13-2.rhaos4.14.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.24-4.rhaos4.13.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.24-4.rhaos4.13.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"haproxy22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.24-4.rhaos4.13.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"haproxy22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.24-4.rhaos4.13.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.24-4.rhaos4.12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.24-4.rhaos4.12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"haproxy22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.24-4.rhaos4.12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"haproxy22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.24-4.rhaos4.12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.24-4.rhaos4.11.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.24-4.rhaos4.11.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"haproxy22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.24-4.rhaos4.11.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"haproxy22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.24-4.rhaos4.11.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.17-6.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.17-6.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.17-6.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-3.el9_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-3.el9_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-3.el9_3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP5","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.16.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.16.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.16.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.16.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.31-150200.11.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.31-150200.11.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.31-150100.8.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.31-0ubuntu0.2"}]}],"versions":["2.0.5-1","2.0.8-1","2.0.9-1","2.0.10-1","2.0.10-1ubuntu1","2.0.11-1ubuntu1","2.0.12-1ubuntu2","2.0.13-1ubuntu2","2.0.13-2","2.0.13-2ubuntu0.1","2.0.13-2ubuntu0.2","2.0.13-2ubuntu0.3","2.0.13-2ubuntu0.5","2.0.29-0ubuntu1","2.0.29-0ubuntu1.1","2.0.29-0ubuntu1.3","2.0.31-0ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22-0ubuntu0.22.04.2"}]}],"versions":["2.2.9-2ubuntu2","2.4.8-1","2.4.8-2ubuntu3","2.4.11-1ubuntu1","2.4.12-1ubuntu1","2.4.12-1ubuntu2","2.4.13-1ubuntu1","2.4.14-1ubuntu1","2.4.18-0ubuntu1","2.4.18-0ubuntu1.1","2.4.18-0ubuntu1.2","2.4.18-0ubuntu1.3","2.4.22-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22-0ubuntu0.22.04.2"}]}],"versions":["2.2.9-2ubuntu2","2.4.8-1","2.4.8-2ubuntu3","2.4.11-1ubuntu1","2.4.12-1ubuntu1","2.4.12-1ubuntu2","2.4.13-1ubuntu1","2.4.14-1ubuntu1","2.4.18-0ubuntu1","2.4.18-0ubuntu1.1","2.4.18-0ubuntu1.2","2.4.18-0ubuntu1.3","2.4.22-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.31-0ubuntu0.2"}]}],"versions":["2.0.5-1","2.0.8-1","2.0.9-1","2.0.10-1","2.0.10-1ubuntu1","2.0.11-1ubuntu1","2.0.12-1ubuntu2","2.0.13-1ubuntu2","2.0.13-2","2.0.13-2ubuntu0.1","2.0.13-2ubuntu0.2","2.0.13-2ubuntu0.3","2.0.13-2ubuntu0.5","2.0.29-0ubuntu1","2.0.29-0ubuntu1.1","2.0.29-0ubuntu1.3","2.0.31-0ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2+git0.61a0f576a-2.1"}]}]}],"products":[{"vendor":"haproxy","product":"haproxy"}],"references":[{"url":"https://github.com/haproxy/haproxy/issues/2237","tags":["x_transferred","Exploit","Issue Tracking","Vendor Advisory","advisory","report"]},{"url":"https://github.com/haproxy/haproxy/commit/6492f1f29d738457ea9f382aca54537f35f9d856","tags":["x_transferred","Patch","fix"]},{"url":"https://www.haproxy.org/download/2.8/src/CHANGELOG","tags":["x_transferred","Release Notes","article","web","report"]},{"url":"https://www.haproxy.org/download/2.7/src/CHANGELOG","tags":["x_transferred","Release Notes","article","web","report"]},{"url":"https://www.haproxy.org/download/2.6/src/CHANGELOG","tags":["x_transferred","Release Notes","article","web","report"]},{"url":"https://cwe.mitre.org/data/definitions/436.html","tags":["x_transferred","Technical Description","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40225","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-xgq7-jp95-v2qv","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1142","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40225","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45539","tags":["report"]},{"url":"https://bugzilla.redhat.com/2231370","tags":["report"]},{"url":"https://bugzilla.redhat.com/2253037","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-1142.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2025-1736503350.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40225.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-40225","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0320.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32319","tags":["report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1541","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7473","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170242","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2231370","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2246310","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7473.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25577","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25577","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25577","tags":["advisory"]},{"url":"https://github.com/pallets/werkzeug/commit/517cac5a804e8c4dc4ed038bb20dacd038e7a9f1","tags":["article"]},{"url":"https://github.com/pallets/werkzeug/releases/tag/2.2.3","tags":["article"]},{"url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-xg9f-g7g7-2323","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40225","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-46136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-46136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46136","tags":["advisory"]},{"url":"https://github.com/pallets/werkzeug/commit/f3c803b3ade485a45f12b6d6617595350c0f03e2","tags":["article"]},{"url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-hrfv-mqp8-q5rw","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7606","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7606.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0200","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0200.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0308","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0308.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1089","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253037","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1089.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45539","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45539","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1142.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233469-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1214102","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40225","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233490-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234646-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1217653","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45539","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-40225","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6294-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6294-2","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-40225","description":"HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.","status":"published","published":"2023-08-10T00:00:00Z","modified":"2024-10-09T20:14:29.797Z","updated_at":"2026-11-02T14:35:21.971258Z"}],"euvd":[{"id":"EUVD-2023-44822","description":"HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.","status":"published","published":"2023-08-10T00:00:00Z","modified":"2024-10-09T20:14:29Z","updated_at":"2026-11-03T00:27:42.031825Z"}],"ghsa":[{"id":"GHSA-xgq7-jp95-v2qv","title":"HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and...","description":"HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.","status":"published","published":"2023-08-10T21:30:45Z","modified":"2024-04-04T06:49:15Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:56:45.955138Z"}],"nvd":[{"id":"CVE-2023-40225","description":"HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.","status":"published","published":"2023-08-10T21:15:10.743Z","modified":"2026-06-17T06:16:49.587Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:08:22.812138Z"}],"osv":[{"id":"AZL-27912","title":"CVE-2023-40225 affecting package haproxy for versions less than 2.4.24-1","description":"HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.","status":"published","published":"2023-08-10T21:15:10Z","modified":"2026-04-21T04:25:43.168743Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"DEBIAN-CVE-2023-40225","description":"HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.","status":"published","published":"2023-08-10T21:15:10.743Z","modified":"2026-10-26T18:01:27.112056261Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"OESA-2023-1541","title":"haproxy security update","description":"HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.\n\nSecurity Fix(es):\n\nHAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.(CVE-2023-40225)","status":"published","published":"2023-08-26T11:05:59Z","modified":"2026-08-18T01:17:52.458359394Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"RHSA-2023:7473","title":"Red Hat Security Advisory: OpenShift Container Platform 4.14.4 packages and security update","status":"published","published":"2024-09-18T05:13:30Z","modified":"2026-08-19T10:02:52Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2023:7606","title":"Red Hat Security Advisory: OpenShift Container Platform 4.13.25 packages and security update","status":"published","published":"2024-09-16T16:01:46Z","modified":"2026-08-05T10:16:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:0200","title":"Red Hat Security Advisory: OpenShift Container Platform 4.12.47 security update","status":"published","published":"2024-09-16T16:01:56Z","modified":"2026-08-05T10:17:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:0308","title":"Red Hat Security Advisory: OpenShift Container Platform 4.11.57 packages and security update","status":"published","published":"2024-09-16T16:02:06Z","modified":"2026-08-05T10:17:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:1089","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2024-09-16T17:36:50Z","modified":"2026-08-05T10:17:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1142","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2024-09-16T17:37:00Z","modified":"2026-08-05T10:18:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"UBUNTU-CVE-2023-40225","description":"HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.","status":"published","published":"2023-08-10T21:15:00Z","modified":"2026-02-04T03:42:07.488257Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"ALSA-2024:1142","title":"Moderate: haproxy security update","description":"The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.\n\nSecurity Fix(es):\n\n* haproxy: Proxy forwards malformed empty Content-Length headers (CVE-2023-40225)\n* haproxy: untrimmed URI fragments may lead to exposure of confidential data on static servers (CVE-2023-45539)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-03-05T00:00:00Z","modified":"2026-10-29T11:32:01.063541758Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"BIT-haproxy-2023-40225","description":"HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.","status":"published","published":"2024-03-06T10:53:12.013Z","modified":"2026-09-08T08:47:51.934666851Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"CLSA-2025-1736503350","title":"haproxy: Fix of CVE-2023-40225","description":"- CVE-2023-40225: Fix forward empty Content-Length headers issue","status":"published","published":"2025-01-10T10:02:37Z","modified":"2026-06-01T00:30:27.351610429Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CVE-2023-40225","description":"HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.","status":"published","published":"2023-08-10T00:00:00Z","modified":"2026-11-02T13:15:24.286570282Z","updated_at":"2026-11-02T15:44:33.244128Z"},{"id":"DSA-5590-1","title":"haproxy - security update","status":"published","published":"2023-12-28T00:00:00Z","modified":"2026-03-09T02:10:22.244837Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2023-0320","title":"Updated haproxy packages fix security vulnerability","description":"Haproxy has fixed security and other issues in last upstream version\n2.8.3 of branch 2.8\n\nDefault user access are now commented out to prevent local action\npossible exploit and prevent further rpmnew on future updates.\n\nUse a check script to have config check result in error log on failure.\n\nFix corruption with non empty access log.\n\nFixed major bug list:\n- quic: Really ignore malformed ACK frames\n- http-ana: Get a fresh trash buffer for each header value replacement\n- h3: reject header values containing invalid chars\n- http: reject any empty content-length header value (CVE-2023-40225)\n\nFixed medium bug list:\n- quic: fix tasklet_wakeup loop on connection closing\n- stconn: Update stream expiration date on blocked sends\n- stconn: Wake applets on sending path if there is a pending shutdown\n- stconn: Don't block sends if there is a pending shutdown\n- h1-htx: Ensure chunked parsing with full output buffer\n- applet: Fix API for function to push new data in channels buffer\n- stconn: Report read activity when a stream is attached to front SC\n- applet: Report an error if applet request more room on aborted SC\n- stconn/stream: Forward shutdown on write timeout\n- stconn: Always update stream's expiration date after I/O\n- capabilities: enable support for Linux capabilities\n- sink: invalid server list in sink_new_from_logsrv()\n- log: improper use of logsrv-\u003emaxlen for buffer targets\n- quic: token IV was not computed using a strong secret\n- quic: missing check of dcid for init pkt including a token\n- quic: timestamp shared in token was using internal time clock\n- hlua_fcn/queue: bad pop_wait sequencing\n- listener: Acquire proxy's lock in relax_listener() if necessary\n- h3: Properly report a C-L header was found to the HTX start-line\n- h3: Be sure to handle fin bit on the last DATA frame\n- bwlim: Reset analyse expiration date when then channel analyse ends\n- quic: consume contig space on requeue datagram\n","status":"published","published":"2023-11-20T10:04:11Z","modified":"2026-04-16T04:43:51.866217118Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13116-1","title":"haproxy-2.8.2+git0.61a0f576a-2.1 on GA media","description":"These are all security issues fixed in the haproxy-2.8.2+git0.61a0f576a-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:10:22.344229Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2023:3469-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\n- CVE-2023-40225: Fixed request smuggling with empty content-length header value (bsc#1214102).\n","status":"published","published":"2023-08-29T07:31:05Z","modified":"2026-02-04T04:09:30.627883Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:3490-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\n- CVE-2023-40225: Fixed request smuggling with empty content-length header value (bsc#1214102).\n","status":"published","published":"2023-08-30T11:58:58Z","modified":"2026-02-04T04:27:33.156591Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:4646-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\n- CVE-2023-45539: Fixed misinterpretation of a path_end rule with # as part of the URI component (bsc#1217653).\n- CVE-2023-40225: reject any empty content-length header value (bsc#1214102).\n","status":"published","published":"2023-12-06T09:42:35Z","modified":"2026-02-04T02:22:26.978621Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"USN-6294-1","title":"haproxy vulnerability","description":"Ben Kallus discovered that HAProxy incorrectly handled empty Content-Length\nheaders. A remote attacker could possibly use this issue to manipulate the\npayload and bypass certain restrictions.\n","status":"published","published":"2023-08-16T14:11:06Z","modified":"2026-02-10T04:43:16Z","updated_at":"2026-11-02T16:58:17.305935Z"},{"id":"USN-6294-2","title":"haproxy vulnerability","description":"USN-6294-1 fixed vulnerabilities in HAProxy. This update provides the\ncorresponding updates for Ubuntu 20.04 LTS.\n\nOriginal advisory details:\n\n Ben Kallus discovered that HAProxy incorrectly handled empty Content-Length\n headers. A remote attacker could possibly use this issue to manipulate the\n payload and bypass certain restrictions.\n","status":"published","published":"2023-08-17T14:53:13Z","modified":"2026-02-10T04:43:16Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}