JVN#38170084: HAProxy vulnerable to HTTP request/response smuggling

HAProxy’s HTTP/3 implementation fails to block a malformed HTTP header field name, and when deployed in front of a server that incorrectly process this malformed header, it may be used to conduct an HTTP request/response smuggling attack (CWE-444).

Impact

A remote attacker may alter a legitimate user’s request. As a result, the attacker may obtain sensitive information or cause a denial-of-service (DoS) condition.

Solution

Update the Software
Update the Software to the latest version according to the information provided by the developer.
The developer addressed the vulnerability in the following versions:

• HAProxy version 2.7.1
• HAProxy version 2.6.8

Products Affected

• HAProxy version 2.7.0
• HAProxy version 2.6.1 to 2.6.7