UpHeron
All vulnerabilities

Servers and applications

CVE-2023-40225

HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.

Severity
High 7.2
Published
10 Aug 2023
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
2.6.15, 2.7.10, 2.8.2
Sources
NVD

Affected software

SoftwareAffected versions
HAProxyServers and applications · cpe:a:haproxy:haproxy
  • Every version up to 2.0.32
  • From 2.2.0 up to 2.2.30
  • From 2.4.0 up to 2.4.23
  • From 2.5.0 before 2.6.15
  • From 2.7.0 before 2.7.10
  • From 2.8.0 before 2.8.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-40225
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-40225