BIT-haproxy-2023-40225: HAProxy HAProxy vulnerability
HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
The issue applies where HAProxy forwards requests with an empty Content-Length header to an HTTP/1 backend server. Exploitation requires the uncommon condition that the backend interprets the request payload as an additional request.
What does an attacker need to send?
An attacker needs to cause HAProxy to forward an HTTP request containing an empty Content-Length header and a payload. The backend HTTP/1 server must then interpret that payload as an extra request.
Which versions need remediation?
Affected releases include HAProxy through 2.0.32; 2.1.x; 2.2.x through 2.2.30; 2.3.x and 2.4.x through 2.4.23; 2.5.x; 2.6.x before 2.6.15; 2.7.x before 2.7.10; and 2.8.x before 2.8.2. Upgrade to 2.6.15, 2.7.10, 2.8.2, or a later applicable release.