CVE-2023-45539

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.

Affected products

Alt Linux, Almalinux, Astra Linux, Centos, Haproxy, Linuxmint, Red Hat, Red Os

Haproxy

< 2.8.2

Fix

Available

CVSS 3.1

8.2 HIGH

EPSS

1.5% (73th percentile)

Weakness

CWE-116

NVD status

Modified

Published

2023-11-28