HTTP Request Smuggling Affecting haproxy package, versions <2.2.9-2+deb11u6
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN11-HAPROXY-5838565
- published 11 Aug 2023
- disclosed 10 Aug 2023
Introduced: 10 Aug 2023
CVE-2023-40225 Open this link in a new tabHow to fix?
Upgrade Debian:11 haproxy to version 2.2.9-2+deb11u6 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream haproxy package and not the haproxy package as distributed by Debian.
See How to fix? for Debian:11 relevant fixed versions and status.
HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.
References
- https://security-tracker.debian.org/tracker/CVE-2023-40225
- https://cwe.mitre.org/data/definitions/436.html
- https://github.com/haproxy/haproxy/commit/6492f1f29d738457ea9f382aca54537f35f9d856
- https://github.com/haproxy/haproxy/issues/2237
- https://www.haproxy.org/download/2.6/src/CHANGELOG
- https://www.haproxy.org/download/2.7/src/CHANGELOG
- https://www.haproxy.org/download/2.8/src/CHANGELOG