High severity7.5NVD Advisory· Published Sep 8, 2021· Updated Jun 17, 2026
CVE-2021-40346
CVE-2021-40346
Description
An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
21cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*+ 8 more
- cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*range: >=2.0.0,<2.0.25
- cpe:2.3:a:haproxy:haproxy:2.5:dev0:*:*:*:*:*:*
- cpe:2.3:a:haproxy:haproxy:2.5:dev1:*:*:*:*:*:*
- cpe:2.3:a:haproxy:haproxy:2.5:dev2:*:*:*:*:*:*
- cpe:2.3:a:haproxy:haproxy:2.5:dev3:*:*:*:*:*:*
- cpe:2.3:a:haproxy:haproxy:2.5:dev4:*:*:*:*:*:*
- cpe:2.3:a:haproxy:haproxy:2.5:dev5:*:*:*:*:*:*
- cpe:2.3:a:haproxy:haproxy:2.5:dev6:*:*:*:*:*:*
- (no CPE)range: 2.0 - 2.5
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
- HAProxy/HAProxydescription
- osv-coords8 versionspkg:bitnami/haproxypkg:rpm/opensuse/haproxy&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/haproxy&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/haproxy&distro=openSUSE%20Tumbleweedpkg:rpm/suse/haproxy&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015pkg:rpm/suse/haproxy&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015%20SP1pkg:rpm/suse/haproxy&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015%20SP2pkg:rpm/suse/haproxy&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015%20SP3
>= 2.0.0, < 2.0.25+ 7 more
- (no CPE)range: >= 2.0.0, < 2.0.25
- (no CPE)range: < 2.0.14-lp152.2.6.1
- (no CPE)range: < 2.0.14-11.11.1
- (no CPE)range: < 2.4.4+git0.acb1d0bea-1.2
- (no CPE)range: < 2.0.14-3.31.1
- (no CPE)range: < 2.0.14-8.23.1
- (no CPE)range: < 2.0.14-11.11.1
- (no CPE)range: < 2.0.14-11.11.1
Patches
Vulnerability mechanics
References
9- github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95nvdPatchThird Party Advisory
- jfrog.com/blog/critical-vulnerability-in-haproxy-cve-2021-40346-integer-overflow-enables-http-smuggling/nvdExploitMitigationThird Party Advisory
- www.debian.org/security/2021/dsa-4968nvdThird Party Advisory
- lists.apache.org/thread.html/r284567dd7523f5823e2ce995f787ccd37b1cc4108779c50a97c79120%40%3Cdev.cloudstack.apache.org%3Envd
- lists.apache.org/thread.html/r8a58fd7a29808e5d27ee56877745e58dc4bb041b9af94601554e2a5a%40%3Cdev.cloudstack.apache.org%3Envd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7V2IYO22LWVBGUNZWVKNTMDV4KINLFO/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXTSBY2TEAXWZVFQM3CXHJFRONX7PEMN/nvd
- www.mail-archive.com/haproxy%40formilux.orgnvd
- www.mail-archive.com/haproxy%40formilux.org/msg41114.htmlnvd
News mentions
0No linked articles in our index yet.