CVE-2021-40346

CVE-2021-40346 — HAProxy Integer Overflow leading to HTTP Request Smuggling 脆弱性概要 HAProxyはオープンソースベースのリバースプロキシ兼ロードバランサーで、負荷分散やACL（アクセス制御ルール）処理などを担当するソフトウェアです。 CVE-2021-40346は、HAProxyがHTTPヘッダーを内部HTXフォーマットで保存するhtxaddheader関数において、ヘッダー名の長さを検証しないために発生するアクセス制御バイパス（ACL Bypass）の脆弱性です。...

Astra Linux – Vulnerability in HAPProxy

There is an integer overflow in HAProxy versions 2.0 to 2.5, specifically in the htxaddheader function, which can be exploited to perform an HTTP request smuggling attack. This allows an attacker to bypass all configured http-request HAProxy Access Control Lists and possibly other access control...

Huawei EulerOS: Security Advisory for haproxy (EulerOS-SA-2021-2916)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

HAProxy input validation error vulnerability

HAProxy is an open source TCP/HTTP load balancing server from the French company HAProxy=. =HAProxy suffers from an input validation error vulnerability, which stems from a lack of header name length checking in the htxaddheader and htxaddtrailer functions in HAProxy, and can be exploited by an...

CVE-2021-40346: Integer Overflow or Wraparound

An integer overflow exists in HAProxy 2.0 through 2.5 in htxaddheader that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs...