BIT-haproxy-2023-25950: High severity HAProxy HAProxy vulnerability

Q: Which HAProxy versions are affected?

HAProxy 2.7.0 and versions 2.6.1 through 2.6.7 are affected.

Q: Can this be exploited remotely without authentication or user interaction?

Yes. The supplied vector indicates network access, low attack complexity, no privileges required, and no user interaction.

Q: What could an attacker achieve?

An attacker could alter another legitimate user's request, potentially exposing sensitive information or causing a denial-of-service condition.

Published Apr 11, 2023

Updated

HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensitive information or cause a denial-of-service (DoS) condition.

Affected Software

1 affected component

HAProxy HAProxy=2.7.0, >=2.6.1<=2.6.7

Event History

Apr 11, 2023

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverity

Frequently Asked Questions

Which HAProxy versions are affected?

HAProxy 2.7.0 and versions 2.6.1 through 2.6.7 are affected.

Can this be exploited remotely without authentication or user interaction?

Yes. The supplied vector indicates network access, low attack complexity, no privileges required, and no user interaction.

What could an attacker achieve?

An attacker could alter another legitimate user's request, potentially exposing sensitive information or causing a denial-of-service condition.

BIT-haproxy-2023-25950: High severity HAProxy HAProxy vulnerability

Affected Software

Event History

Frequently Asked Questions

Which HAProxy versions are affected?

Can this be exploited remotely without authentication or user interaction?

What could an attacker achieve?

Company

Resources

Contact

Frequently Asked Questions

Which HAProxy versions are affected?

Can this be exploited remotely without authentication or user interaction?

What could an attacker achieve?