CVEvulnerability

CVE-2023-25725

9.1 CRITICAL Published 2023-02-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-02-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-444

Description

HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3, the impact is limited because the headers disappear before being parsed and processed, as if they had not been sent by the client. The fixed versions are 2.7.3, 2.6.9, 2.5.12, 2.4.22, 2.2.29, and 2.0.31.

Affected configurations

• haproxy haproxy (< 2.0.31) • haproxy haproxy (>= 2.1.0 < 2.2.29) • haproxy haproxy (>= 2.3.0 < 2.4.22) • haproxy haproxy (>= 2.5.0 < 2.5.12) • haproxy haproxy (>= 2.6.0 < 2.6.9) • haproxy haproxy (>= 2.7.0 < 2.7.3) • debian debian linux 10.0 • debian debian linux 11.0

Related

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References