CVE-2021-40346

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-09-17T21:06:26.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.mail-archive.com/haproxy%40formilux.org"}, {"tags": ["x_refsource_MISC"], "url": "https://git.haproxy.org/?p=haproxy.git"}, {"name": "DSA-4968", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "https://www.debian.org/security/2021/dsa-4968"}, {"tags": ["x_refsource_MISC"], "url": "https://www.mail-archive.com/haproxy%40formilux.org/msg41114.html"}, {"tags": ["x_refsource_MISC"], "url": "https://jfrog.com/blog/critical-vulnerability-in-haproxy-cve-2021-40346-integer-overflow-enables-http-smuggling/"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95"}, {"name": "[cloudstack-dev] 20210910 CVE-2021-40346 (haproxy 2.x)", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/r284567dd7523f5823e2ce995f787ccd37b1cc4108779c50a97c79120%40%3Cdev.cloudstack.apache.org%3E"}, {"name": "[cloudstack-dev] 20210910 Re: CVE-2021-40346 (haproxy 2.x)", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/r8a58fd7a29808e5d27ee56877745e58dc4bb041b9af94601554e2a5a%40%3Cdev.cloudstack.apache.org%3E"}, {"name": "FEDORA-2021-3493f9f6ab", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7V2IYO22LWVBGUNZWVKNTMDV4KINLFO/"}, {"name": "FEDORA-2021-cd5ee418f6", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXTSBY2TEAXWZVFQM3CXHJFRONX7PEMN/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2021-40346", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://www.mail-archive.com/haproxy@formilux.org", "refsource": "MISC", "url": "https://www.mail-archive.com/haproxy@formilux.org"}, {"name": "https://git.haproxy.org/?p=haproxy.git", "refsource": "MISC", "url": "https://git.haproxy.org/?p=haproxy.git"}, {"name": "DSA-4968", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2021/dsa-4968"}, {"name": "https://www.mail-archive.com/haproxy@formilux.org/msg41114.html", "refsource": "MISC", "url": "https://www.mail-archive.com/haproxy@formilux.org/msg41114.html"}, {"name": "https://jfrog.com/blog/critical-vulnerability-in-haproxy-cve-2021-40346-integer-overflow-enables-http-smuggling/", "refsource": "MISC", "url": "https://jfrog.com/blog/critical-vulnerability-in-haproxy-cve-2021-40346-integer-overflow-enables-http-smuggling/"}, {"name": "https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95", "refsource": "MISC", "url": "https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95"}, {"name": "[cloudstack-dev] 20210910 CVE-2021-40346 (haproxy 2.x)", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r284567dd7523f5823e2ce995f787ccd37b1cc4108779c50a97c79120@%3Cdev.cloudstack.apache.org%3E"}, {"name": "[cloudstack-dev] 20210910 Re: CVE-2021-40346 (haproxy 2.x)", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r8a58fd7a29808e5d27ee56877745e58dc4bb041b9af94601554e2a5a@%3Cdev.cloudstack.apache.org%3E"}, {"name": "FEDORA-2021-3493f9f6ab", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A7V2IYO22LWVBGUNZWVKNTMDV4KINLFO/"}, {"name": "FEDORA-2021-cd5ee418f6", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MXTSBY2TEAXWZVFQM3CXHJFRONX7PEMN/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T02:27:31.887Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.mail-archive.com/haproxy%40formilux.org"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://git.haproxy.org/?p=haproxy.git"}, {"name": "DSA-4968", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "https://www.debian.org/security/2021/dsa-4968"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.mail-archive.com/haproxy%40formilux.org/msg41114.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://jfrog.com/blog/critical-vulnerability-in-haproxy-cve-2021-40346-integer-overflow-enables-http-smuggling/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95"}, {"name": "[cloudstack-dev] 20210910 CVE-2021-40346 (haproxy 2.x)", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/r284567dd7523f5823e2ce995f787ccd37b1cc4108779c50a97c79120%40%3Cdev.cloudstack.apache.org%3E"}, {"name": "[cloudstack-dev] 20210910 Re: CVE-2021-40346 (haproxy 2.x)", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/r8a58fd7a29808e5d27ee56877745e58dc4bb041b9af94601554e2a5a%40%3Cdev.cloudstack.apache.org%3E"}, {"name": "FEDORA-2021-3493f9f6ab", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7V2IYO22LWVBGUNZWVKNTMDV4KINLFO/"}, {"name": "FEDORA-2021-cd5ee418f6", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXTSBY2TEAXWZVFQM3CXHJFRONX7PEMN/"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2021-40346", "datePublished": "2021-09-08T16:40:38.000Z", "dateReserved": "2021-08-31T00:00:00.000Z", "dateUpdated": "2024-08-04T02:27:31.887Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*", "matchCriteriaId": "2050D7B9-9E52-4564-9136-ABDB74F447A4", "versionEndExcluding": "2.0.25", "versionStartIncluding": "2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*", "matchCriteriaId": "4F0B3A48-87CC-490D-8C45-8BD6CCC01F80", "versionEndExcluding": "2.2.17", "versionStartIncluding": "2.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*", "matchCriteriaId": "677D5326-42B8-4DF5-A4C3-AEA5EBBA2164", "versionEndExcluding": "2.3.14", "versionStartIncluding": "2.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*", "matchCriteriaId": "CED60B4E-A8D6-47C8-8E62-FB1E8224E51F", "versionEndExcluding": "2.4.4", "versionStartIncluding": "2.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:haproxy:haproxy:2.5:dev0:*:*:*:*:*:*", "matchCriteriaId": "4FC0BDE1-8904-4E26-B218-9F5FFF0F6F5D", "vulnerable": true}, {"criteria": "cpe:2.3:a:haproxy:haproxy:2.5:dev1:*:*:*:*:*:*", "matchCriteriaId": "2325B4E6-F5FE-4978-8AD7-9FDBF8D0355C", "vulnerable": true}, {"criteria": "cpe:2.3:a:haproxy:haproxy:2.5:dev2:*:*:*:*:*:*", "matchCriteriaId": "CD24FF4B-8E71-4111-AA2E-DC4DBC7D4961", "vulnerable": true}, {"criteria": "cpe:2.3:a:haproxy:haproxy:2.5:dev3:*:*:*:*:*:*", "matchCriteriaId": "4589E520-FABF-438D-A7FB-EEDFD6EF75E5", "vulnerable": true}, {"criteria": "cpe:2.3:a:haproxy:haproxy:2.5:dev4:*:*:*:*:*:*", "matchCriteriaId": "3F9374A2-4E60-4BD7-81B0-53A8CE8019D1", "vulnerable": true}, {"criteria": "cpe:2.3:a:haproxy:haproxy:2.5:dev5:*:*:*:*:*:*", "matchCriteriaId": "D2291792-4194-4708-93E8-762B920B6DB0", "vulnerable": true}, {"criteria": "cpe:2.3:a:haproxy:haproxy:2.5:dev6:*:*:*:*:*:*", "matchCriteriaId": "42A575A1-A115-4AE7-8FEF-40356A9B17CD", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*", "matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*", "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs."}, {"lang": "es", "value": "Se presenta un desbordamiento de enteros en HAProxy versiones 2.0 a 2.5, en la funci\u00f3n htx_add_header() que puede ser explotada para llevar a cabo un ataque de contrabando de peticiones HTTP, permitiendo a un atacante omitir todas las ACLs configuradas de HAProxy de peticiones http y posiblemente otras ACLs"}], "id": "CVE-2021-40346", "lastModified": "2026-06-17T04:06:46.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-09-08T17:15:12.457", "references": [{"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://git.haproxy.org/?p=haproxy.git"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://jfrog.com/blog/critical-vulnerability-in-haproxy-cve-2021-40346-integer-overflow-enables-http-smuggling/"}, {"source": "cve@mitre.org", "url": "https://lists.apache.org/thread.html/r284567dd7523f5823e2ce995f787ccd37b1cc4108779c50a97c79120%40%3Cdev.cloudstack.apache.org%3E"}, {"source": "cve@mitre.org", "url": "https://lists.apache.org/thread.html/r8a58fd7a29808e5d27ee56877745e58dc4bb041b9af94601554e2a5a%40%3Cdev.cloudstack.apache.org%3E"}, {"source": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7V2IYO22LWVBGUNZWVKNTMDV4KINLFO/"}, {"source": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXTSBY2TEAXWZVFQM3CXHJFRONX7PEMN/"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2021/dsa-4968"}, {"source": "cve@mitre.org", "url": "https://www.mail-archive.com/haproxy%40formilux.org"}, {"source": "cve@mitre.org", "url": "https://www.mail-archive.com/haproxy%40formilux.org/msg41114.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://git.haproxy.org/?p=haproxy.git"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://jfrog.com/blog/critical-vulnerability-in-haproxy-cve-2021-40346-integer-overflow-enables-http-smuggling/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/r284567dd7523f5823e2ce995f787ccd37b1cc4108779c50a97c79120%40%3Cdev.cloudstack.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/r8a58fd7a29808e5d27ee56877745e58dc4bb041b9af94601554e2a5a%40%3Cdev.cloudstack.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7V2IYO22LWVBGUNZWVKNTMDV4KINLFO/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXTSBY2TEAXWZVFQM3CXHJFRONX7PEMN/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2021/dsa-4968"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.mail-archive.com/haproxy%40formilux.org"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.mail-archive.com/haproxy%40formilux.org/msg41114.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2022:0024", "cpe": "cpe:/a:redhat:openshift:4.6::el7", "package": "haproxy-0:2.0.16-4.el8", "product_name": "Red Hat OpenShift Container Platform 4.6", "release_date": "2022-01-12T00:00:00Z"}, {"advisory": "RHSA-2022:0114", "cpe": "cpe:/a:redhat:openshift:4.7::el7", "package": "haproxy-0:2.0.19-2.el7", "product_name": "Red Hat OpenShift Container Platform 4.7", "release_date": "2022-01-19T00:00:00Z"}, {"advisory": "RHSA-2021:5208", "cpe": "cpe:/a:redhat:openshift:4.8::el7", "package": "haproxy-0:2.2.13-2.el8", "product_name": "Red Hat OpenShift Container Platform 4.8", "release_date": "2022-01-05T00:00:00Z"}, {"advisory": "RHSA-2021:4118", "cpe": "cpe:/a:redhat:openshift:4.9::el8", "package": "haproxy-0:2.2.15-2.el8", "product_name": "Red Hat OpenShift Container Platform 4.9", "release_date": "2021-11-10T00:00:00Z"}], "bugzilla": {"description": "haproxy: request smuggling attack or response splitting via duplicate content-length header", "id": "2000599", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2000599"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "status": "verified"}, "cwe": "CWE-444", "details": ["An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.", "Proxy server haproxy has a flaw that can could allow an HTTP request smuggling attack with the goal of bypassing access-control list rules defined by haproxy. The attack was made possible by utilizing an integer overflow vulnerability that allowed reaching an unexpected state in haproxy while parsing an HTTP request. The highest threat from this vulnerability is integrity."], "mitigation": {"lang": "en:us", "value": "To mitigate this problem the following can be added to proxy config:\nhttp-request deny if { req.hdr_cnt(content-length) gt 1 }\nhttp-response deny if { res.hdr_cnt(content-length) gt 1 }"}, "name": "CVE-2021-40346", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "haproxy", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "haproxy", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "haproxy", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "haproxy", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Out of support scope", "package_name": "haproxy", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:rhel_software_collections:3", "fix_state": "Not affected", "package_name": "rh-haproxy18-haproxy", "product_name": "Red Hat Software Collections"}], "public_date": "2021-09-08T17:37:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-40346\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-40346\nhttps://www.haproxy.org/download/2.4/src/CHANGELOG"], "threat_severity": "Moderate"}

{}