CVE-2023-25725 is a critical vulnerability in HAProxy versions prior to 2.7.3, allowing for HTTP request smuggling due to improper handling of HTTP/1 headers, potentially bypassing access controls. With a CVSS score of 9.1 (CRITICAL), it presents a high risk of integrity and availability impact, requiring no user interaction or complex attack conditions. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion, indicating awareness. Organizations using affected HAProxy versions should prioritize patching to mitigate this significant risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.0.31CPE matchmatch criteria | cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* | ||
>= 2.1.0, < 2.2.29CPE matchmatch criteria | cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* | ||
>= 2.3.0, < 2.4.22CPE matchmatch criteria | cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* | ||
>= 2.5.0, < 2.5.12CPE matchmatch criteria | cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* | ||
>= 2.6.0, < 2.6.9CPE matchmatch criteria | cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2023-25725
Jun 13, 2023haproxy: request smuggling attack in HTTP/1 header parsing
Feb 14, 2023HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names which could be used to truncate the list of HTTP headers and thus make some headers disappear after being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3 the impact is limited because the headers disappear before being parsed and processed as if they had not been sent by the client. The fixed versions are 2.7.3 2.6.9 2.5.12 2.4.22 2.2.29 and 2.0.31.
Feb 14, 2023