CVE-2021-40346

An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker…

published September 8, 2021

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.1th percentile for exploit probability.

CVSS
—
EPSS
59%
Percentile
99.1
In the wild
Unconfirmed
What it is

An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.58832 · 99.1th percentile
Published
2021-09-08T16:40Z
EPSS history
Timeline
  • 08 SEP 16:40Z
    An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker…
    cvelistv5