CVE-2023-40225

HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.

Affected products

Alt Linux, Almalinux, Astra Linux, Haproxy, Linuxmint, Red Hat, Red Os, Suse

Haproxy

≤ 2.0.32, 2.2.30, 2.4.23, 2.6.15, 2.7.10, 2.8.2

Fix

Available

CVSS 3.1

7.2 HIGH

EPSS

1.8% (77th percentile)

Weakness

CWE-444

NVD status

Modified

Published

2023-08-10

No exploit for CVE-2023-40225 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.