Skip to content
OpenAdvisories
Unscored USN-5063-1 1 CVE

haproxy vulnerabilities

Published Sep 8, 2021 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Ori Hollander discovered that HAProxy incorrectly handled HTTP header name
length encoding. A remote attacker could possibly use this issue to inject
a duplicate content-length header and perform request smuggling attacks.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS haproxy 2.0.13-2ubuntu0.3

Vulnerabilities 1

  • Unscored —
    CVE-2021-40346 Public exploit EPSS 59%

    An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP reques…

    haproxy haproxy Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2021-40346