CVE-2023-25725
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-25725
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-25725.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-25725
- Aliases
- Related
- Published
- 2023-02-14T19:15:11Z
- Modified
- 2025-02-19T03:33:50.179618Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3, the impact is limited because the headers disappear before being parsed and processed, as if they had not been sent by the client. The fixed versions are 2.7.3, 2.6.9, 2.5.12, 2.4.22, 2.2.29, and 2.0.31.
- References
-
- https://www.debian.org/security/2023/dsa-5348
- https://lists.debian.org/debian-lts-announce/2023/02/msg00012.html
- https://git.haproxy.org/?p=haproxy-2.7.git%3Ba=commit%3Bh=a0e561ad7f29ed50c473f5a9da664267b60d1112
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPTJQHKUEU2PQ7RWFUYAFLAD4STEIKHU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JM5NCIBTHYDTLPY2UNC4HO2VAHHE6CJG/
- https://www.haproxy.org/
- https://security-tracker.debian.org/tracker/CVE-2023-25725
Affected packages
Debian:11 / haproxy
Package
- Name
- haproxy
- Purl
- pkg:deb/debian/haproxy?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.2.9-2+deb11u4
Debian:12 / haproxy
Package
- Name
- haproxy
- Purl
- pkg:deb/debian/haproxy?arch=source
Debian:13 / haproxy
Package
- Name
- haproxy
- Purl
- pkg:deb/debian/haproxy?arch=source
Git / git.haproxy.org/haproxy-2.0.git
Affected ranges
- Type
- GIT
- Repo
- https://git.haproxy.org/haproxy-2.0.git
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedc8b1c15af1934dcdf260312d8e8906fff2c13427
- Type
- GIT
- Repo
- https://git.haproxy.org/haproxy-2.2.git
- Events
-
Introducede54b43af1ec9dc656c04b09118583cb3c2ce56faFixedc5b927c8f535cd3ae206285b2a5181e056f91821
- Type
- GIT
- Repo
- https://git.haproxy.org/haproxy-2.4.git
- Events
-
Introduced1c0a722a83e7c45456a2b82c15889ab9ab5c4948Fixedf8e3218e2a30b1d08ee9caa5c7058e4f0b4c99d7
- Type
- GIT
- Repo
- https://git.haproxy.org/haproxy-2.7.git
- Events
-
Introduceda1efc048bf8a5e14466dbe7317e73117e8d66176Fixede979796584266caca16250c64cec65d5ec6ff33c
- Type
- GIT
- Repo
- https://git.haproxy.org/haproxy.git
- Events
-
Introduced437fd289f2e32e56498d2d4da63852d483f284efFixed87e95d38a9b9b69462569cc75fd1687b3605be7b
- Type
- GIT
- Repo
- https://github.com/haproxy/haproxy
- Events
Affected versions
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.1.0
v1.1.1
v1.1.10
v1.1.11
v1.1.12
v1.1.13
v1.1.14
v1.1.15
v1.1.16
v1.1.17
v1.1.18
v1.1.19
v1.1.2
v1.1.20
v1.1.21
v1.1.22
v1.1.23
v1.1.24
v1.1.25
v1.1.26
v1.1.27
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v1.2.0
v1.2.1
v1.2.1-pre1
v1.2.1-pre2
v1.2.1-pre3
v1.2.10
v1.2.10.1
v1.2.11
v1.2.11.1
v1.2.12
v1.2.13
v1.2.13.1
v1.2.14
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.2.5-pre1
v1.2.5-pre2
v1.2.5-pre3
v1.2.5-pre4
v1.2.5.1
v1.2.5.2
v1.2.6
v1.2.6-pre4
v1.2.6-pre5
v1.2.7
v1.2.7.1
v1.2.7rc
v1.2.8
v1.2.9
v1.3.0
v1.3.1
v1.3.10
v1.3.10.1
v1.3.10.2
v1.3.11
v1.3.11.1
v1.3.11.2
v1.3.11.3
v1.3.11.4
v1.3.12
v1.3.13
v1.3.14
v1.3.15
v1.3.16
v1.3.16-rc1
v1.3.16-rc2
v1.3.17
v1.3.18
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.3.6.1
v1.3.7
v1.3.8
v1.3.8.1
v1.3.8.2
v1.3.9
v1.4-dev0
v1.4-dev1
v1.4-dev2
v1.4-dev3
v1.4-dev4
v1.4-dev5
v1.4-dev6
v1.4-dev7
v1.4-dev8
v1.4-rc1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.5-dev10
v1.5-dev12
v1.5-dev13
v1.5-dev14
v1.5-dev15
v1.5-dev16
v1.5-dev17
v1.5-dev18
v1.5-dev19
v1.5-dev20
v1.5-dev21
v1.5-dev22
v1.5-dev23
v1.5-dev24
v1.5-dev25
v1.5-dev26
v1.5-dev8
v1.5-dev9
v1.5.0
v1.6-dev0
v1.6-dev1
v1.6-dev2
v1.6-dev3
v1.6-dev4
v1.6-dev5
v1.6-dev6
v1.6-dev7
v1.6.0
v1.7-dev0
v1.7-dev1
v1.7-dev2
v1.7-dev3
v1.7-dev4
v1.7-dev5
v1.7-dev6
v1.7.0
v1.8-dev0
v1.8-dev1
v1.8-dev2
v1.8-dev3
v1.8-rc1
v1.8-rc2
v1.8-rc3
v1.8-rc4
v1.8.0
v1.9-dev0
v1.9-dev1
v1.9-dev10
v1.9-dev11
v1.9-dev2
v1.9-dev3
v1.9-dev4
v1.9-dev5
v1.9-dev6
v1.9-dev7
v1.9-dev8
v1.9-dev9
v1.9.0
v2.*
v2.0-dev0
v2.0-dev1
v2.0-dev2
v2.0-dev3
v2.0-dev4
v2.0-dev5
v2.0-dev6
v2.0-dev7
v2.0.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.16
v2.0.17
v2.0.18
v2.0.19
v2.0.2
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.24
v2.0.25
v2.0.26
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.30
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1.0
v2.2-dev0
v2.2-dev1
v2.2-dev10
v2.2-dev11
v2.2-dev12
v2.2-dev2
v2.2-dev3
v2.2-dev4
v2.2-dev5
v2.2-dev6
v2.2-dev7
v2.2-dev8
v2.2-dev9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.12
v2.2.13
v2.2.14
v2.2.15
v2.2.16
v2.2.17
v2.2.18
v2.2.19
v2.2.2
v2.2.20
v2.2.21
v2.2.22
v2.2.23
v2.2.24
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0
v2.4-dev0
v2.4-dev1
v2.4-dev10
v2.4-dev11
v2.4-dev12
v2.4-dev13
v2.4-dev14
v2.4-dev15
v2.4-dev16
v2.4-dev17
v2.4-dev18
v2.4-dev19
v2.4-dev2
v2.4-dev3
v2.4-dev4
v2.4-dev5
v2.4-dev6
v2.4-dev7
v2.4-dev8
v2.4-dev9
v2.4.0
v2.4.1
v2.4.10
v2.4.11
v2.4.12
v2.4.13
v2.4.14
v2.4.15
v2.4.16
v2.4.17
v2.4.18
v2.4.19
v2.4.2
v2.4.20
v2.4.21
v2.4.3
v2.4.4
v2.4.5
v2.4.6
v2.4.7
v2.4.8
v2.4.9
v2.5.0
v2.6.0
v2.7.0