Vulnerability · Published Sep 8, 2021 · Assigned by mitre

CVE-2021-40346

High 7.5

In plain English

A high-severity security flaw in the haproxy package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 58.8% (higher than 99.1% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High

Exploit odds (30 days)58.8%top 0.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Public PoC

Official description

An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	haproxy	2.2.16-3	DEBIAN-CVE-2021-40346
Debian:13	haproxy	2.2.16-3	DEBIAN-CVE-2021-40346
Debian:14	haproxy	2.2.16-3	DEBIAN-CVE-2021-40346
Ubuntu:22.04:LTS	haproxy	2.2.9-2ubuntu2	UBUNTU-CVE-2021-40346

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.mail-archive.com/haproxy%40formilux.org x_refsource_MISC
https://git.haproxy.org/?p=haproxy.git x_refsource_MISC
DSA-4968 vendor-advisory, x_refsource_DEBIAN
https://www.mail-archive.com/haproxy%40formilux.org/msg41114.html x_refsource_MISC
https://jfrog.com/blog/critical-vulnerability-in-haproxy-cve-2021-40346-integer-overflow-enables-http-smuggling/ x_refsource_MISC
https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95 x_refsource_MISC
[cloudstack-dev] 20210910 CVE-2021-40346 (haproxy 2.x) mailing-list, x_refsource_MLIST
[cloudstack-dev] 20210910 Re: CVE-2021-40346 (haproxy 2.x) mailing-list, x_refsource_MLIST
FEDORA-2021-3493f9f6ab vendor-advisory, x_refsource_FEDORA
FEDORA-2021-cd5ee418f6 vendor-advisory, x_refsource_FEDORA