Most recent entries from all

BIT-haproxy-2023-25950

Affected: Bitnami: haproxy

HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensitive information or cause a denial-of-service (DoS) condition.

EUVD-2026-214625

fkie_cve-2023-25950

GHSA-g72c-cx82-64hq

gsd-2023-25950

jvndb-2023-000030

HAProxy's HTTP/3 implementation fails to block a malformed HTTP header field name, and when deployed in front of a server that incorrectly process this malformed header, it may be used to conduct an HTTP request/response smuggling attack (CWE-444). Yuki Mogi of FFRI Security, Inc. reported this vulnerability to the developer and coordinated. The developer and JPCERT/CC published this advisory in order to notify users of this vulnerability.

OESA-2023-1257 — haproxy security update

Affected: openEuler:22.03-LTS-SP1: haproxy

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones. Security Fix(es): HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensitive information or cause a denial-of-service (DoS) condition.(CVE-2023-25950)

WID-SEC-W-2023-0819 — HAProxy Enterprise: Schwachstelle ermöglicht HTTP Request Smuggling

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in HAProxy Enterprise ausnutzen, um einen HTTP Request Smuggling Angriff durchzuführen.