UpHeron
All vulnerabilities

Servers and applications

CVE-2021-39240

An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve.

Severity
High 7.5
Published
17 Aug 2021
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
2.2.16, 2.3.13, 2.4.3
Sources
NVD

Affected software

SoftwareAffected versions
HAProxyServers and applications · cpe:a:haproxy:haproxy
  • From 2.2.0 before 2.2.16
  • From 2.3.0 before 2.3.13
  • From 2.4.0 before 2.4.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-39240
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-39240