CVE-2023-25725: Inconsistent Interpretation of HTTP Requests

HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some...

CVE-2023-25725

HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some...

DLA-3318-1 haproxy - security update

Bulletin has no description...

PT-2023-1389

Name of the Vulnerable Software and Affected Versions HAProxy versions prior to 2.7.3 HAProxy versions prior to 2.6.9 HAProxy versions prior to 2.5.12 HAProxy versions prior to 2.4.22 HAProxy versions prior to 2.2.29 HAProxy versions prior to 2.0.31 Description The issue is related to the handlin...

CVE-2023-25725

HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some...

CVE-2023-25725

HAProxy URL: CVE-2023-25725 affects HAProxy with HTTP/1 header parsing issues that may allow bypassing access control via request smuggling. The root cause is that the HTTP header parsers can accept empty header field names, potentially truncating the header list and causing headers to disappear ...

CVE-2023-25725

HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some...

CVE-2023-25725

HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some...

Low: Red Hat Security Advisory: RHUI 4.3.0 release - Security Fixes, Bug Fixes, and Enhancements Update

An updated version of Red Hat Update Infrastructure RHUI is now available. RHUI 4.3 fixes a security bug, introduces multiple new features, and upgrades underlying Pulp to a Long Term Support LTS version. Red Hat Update Infrastructure RHUI offers a highly scalable, highly redundant framework that...

codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS

A flaw was found in codec-haproxy from the Netty project. This flaw allows an attacker to build a malformed crafted message and cause infinite recursion, causing stack exhaustion and leading to a denial of service DoS...

SUSE-SU-2023:0153-1 Security update for haproxy

This update for haproxy fixes the following issues: - CVE-2023-0056: Fixed a server crash that could be triggered via a malformed HTTP/2 frame bsc1207181...

SUSE SLES15 / openSUSE 15 Security Update : haproxy (SUSE-SU-2023:0153-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:0153-1 advisory. - CVE-2023-0056: Fixed a server crash that could be triggered via a malformed HTTP/2 frame bsc1207181. Tenable has extracted the preceding...

Denial Of Service (DoS)

haproxy is vulnerable to Denial of Service DoS attacks. A remote attacker is able to cause the server to stop responding, which results in denial of service conditions due to incorrect handling of certain messages...

Ubuntu: Security Advisory (USN-5819-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Haproxy 资源管理错误漏洞

Haproxy HAProxy is an open source TCP/HTTP load balancing server from the French company Haproxy. The server provides 4-layer and 7-layer proxies and can support tens of thousands of connection levels, with high efficiency and stability. HAProxy has a security vulnerability that stems from...

USN-5819-1: HAProxy vulnerability

It was discovered that HAProxy incorrectly handled certain messages. A remote attacker could possibly use this issue to cause HAProxy to stop responding, resulting in a denial of service...

USN-5819-1 haproxy vulnerability

It was discovered that HAProxy incorrectly handled certain messages. A remote attacker could possibly use this issue to cause HAProxy to stop responding, resulting in a denial of service...

RHEL 7 : OpenShift Container Platform 3.11 (RHSA-2020:1287)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1287 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...

RHEL 7 : rh-haproxy18-haproxy (RHSA-2020:2265)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2265 advisory. HAProxy is a TCP/HTTP reverse proxy which is particularly suited for high availability environments. The following packages have been upgrad...

RHEL 7 : rh-haproxy18-haproxy (RHSA-2020:1290)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1290 advisory. HAProxy is a TCP/HTTP reverse proxy which is particularly suited for high availability environments. Security Fixes: haproxy: malformed HTTP/2 reques...