Description
An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | haproxy | 2.2.16-3 | — |
| Debian 13 | haproxy | 2.2.16-3 | — |
| Debian 12 | haproxy | 2.2.16-3 | — |
| Debian 11 | haproxy | 2.2.9-2+deb11u2 | DSA-4968-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | haproxy | 2.2.9-2ubuntu2 | — |
| Ubuntu 20.04 LTS | haproxy | 2.0.13-2ubuntu0.3 | USN-5063-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | haproxy +1 | 2.0.16-2.el7 | RHSA-2022:0114, RHSA-2022:0024, RHSA-2021:5208 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | haproxy | 2.0.14-11.11.1 | SUSE-SU-2021:2975-1 |
| SLES 15 SP2 | haproxy | 2.0.14-11.11.1 | SUSE-SU-2021:2975-1 |
| SLES 15 SP1 | haproxy | 2.0.14-8.23.1 | SUSE-SU-2021:3257-1 |
| SLES 15 | haproxy | 2.0.14-3.31.1 | SUSE-SU-2021:3258-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | haproxy | 2.4.4+git0.acb1d0bea-1.2 | openSUSE-SU-2024:10839-1 |
| openSUSE Leap 15.3 | haproxy | 2.0.14-11.11.1 | openSUSE-SU-2021:2975-1 |
| openSUSE Leap 15.2 | haproxy | 2.0.14-lp152.2.6.1 | openSUSE-SU-2021:1329-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 7 repositories
-
knqyf263/CVE-2021-40346 ★ 41 · Sep 8, 2021
CVE-2021-40346 PoC (HAProxy HTTP Smuggling)
-
donky16/CVE-2021-40346-POC ★ 32 · Sep 10, 2021
CVE-2021-40346 integer overflow enables http smuggling
-
Vulnmachines/HAProxy_CVE-2021-40346 ★ 5 · Nov 8, 2021
HAProxy CVE-2021-40346
-
alikarimi999/CVE-2021-40346 ★ 5 · Sep 10, 2021
-
jmg0929/CVE-2021-40346 ★ 0 · Jul 8, 2026
WHS CVE-2021-40346 분석
-
BoianEduard/CVE-2021-40346 ★ 0 · Dec 21, 2025
HTTP Request Smuggling
-
alexOarga/CVE-2021-40346 ★ 0 · Jan 24, 2022
CVE-2021-40346 - HaProxy HTTP request smuggling through integer overflow
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 13
- DSA-4968-1 haproxy - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-5063-1 haproxy vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:10839-1 haproxy-2.4.4+git0.acb1d0bea-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:2975-1 Security update for haproxy SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:2975-1 Security update for haproxy SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:1329-1 Security update for haproxy SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:3258-1 Security update for haproxy SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:3257-1 Security update for haproxy SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2021:5208 Red Hat Security Advisory: OpenShift Container Platform 4.8.25 security update Red Hat Security Advisories (RHSA) · Dec 18, 2025
- RHSA-2022:0114 Red Hat Security Advisory: OpenShift Container Platform 4.7.41 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2022:0024 Red Hat Security Advisory: OpenShift Container Platform 4.6.53 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2021:4118 Red Hat Security Advisory: OpenShift Container Platform 4.9.6 packages and security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- WID-SEC-2023-2456 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 27, 2023
References
- https://www.mail-archive.com/haproxy%40formilux.org
- https://git.haproxy.org/?p=haproxy.git
- DSA-4968 vendor-advisory
- https://www.mail-archive.com/haproxy%40formilux.org/msg41114.html
- https://jfrog.com/blog/critical-vulnerability-in-haproxy-cve-2021-40346-integer-overflow-enables-http-smuggling/
- https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95
- [cloudstack-dev] 20210910 CVE-2021-40346 (haproxy 2.x) mailing-list
- [cloudstack-dev] 20210910 Re: CVE-2021-40346 (haproxy 2.x) mailing-list
- FEDORA-2021-3493f9f6ab vendor-advisory
- FEDORA-2021-cd5ee418f6 vendor-advisory