CVE-2023-25950

2023-04-1100:00:00

jpcert

www.cve.org

http

request smuggling

response

vulnerability

haproxy

version 2.7.0

version 2.6.1

version 2.6.7

remote attacker

alteration

user requests

information disclosure

dos

7.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.5%

JSON

HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user’s request. As a result, the attacker may obtain sensitive information or cause a denial-of-service (DoS) condition.

CNA Affected

[
  {
    "vendor": "HAProxy Technologies",
    "product": "HAProxy",
    "versions": [
      {
        "version": "version 2.7.0, and version 2.6.1 to 2.6.7",
        "status": "affected"
      }
    ]
  }
]