High
CVE-2021-40346
An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.
Announced Group revision 1
Original source ↗CVE-2021-40346
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:CVE-2021-40346
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"repo": "https://github.com/haproxy/haproxy",
"type": "GIT",
"events": [
{
"introduced": "6cbbecf09734aeb5fa8bb88f36f06a6f6d35e813"
},
{
"fixed": "4d711760de1ca0a3734a0a813cb0012dc3d2628a"
},
{
"introduced": "f2e0833f16aa8c09e1c7001ff55aac4f13c643b7"
},
{
"last_affected": "f653e83064345fc303597af6c6aff44a704e5477"
},
{
"fixed": "3b69886f7dcc3cfb3d166309018e6cfec9ce2c95"
}
],
"database_specific": {
"cpe": [
"cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*",
"cpe:2.3:a:haproxy:haproxy:2.5:dev0:*:*:*:*:*:*",
"cpe:2.3:a:haproxy:haproxy:2.5:dev1:*:*:*:*:*:*",
"cpe:2.3:a:haproxy:haproxy:2.5:dev2:*:*:*:*:*:*",
"cpe:2.3:a:haproxy:haproxy:2.5:dev3:*:*:*:*:*:*",
"cpe:2.3:a:haproxy:haproxy:2.5:dev4:*:*:*:*:*:*",
"cpe:2.3:a:haproxy:haproxy:2.5:dev5:*:*:*:*:*:*",
"cpe:2.3:a:haproxy:haproxy:2.5:dev6:*:*:*:*:*:*"
],
"source": [
"CPE_RANGE",
"CPE_STRING",
"REFERENCES"
],
"extracted_events": [
{
"introduced": "2.4.0"
},
{
"fixed": "2.4.4"
},
{
"introduced": "2.5-dev0"
},
{
"last_affected": "2.5-dev0"
},
{
"introduced": "2.5-dev1"
},
{
"last_affected": "2.5-dev1"
},
{
"introduced": "2.5-dev2"
},
{
"last_affected": "2.5-dev2"
},
{
"introduced": "2.5-dev3"
},
{
"last_affected": "2.5-dev3"
},
{
"introduced": "2.5-dev4"
},
{
"last_affected": "2.5-dev4"
},
{
"introduced": "2.5-dev5"
},
{
"last_affected": "2.5-dev5"
},
{
"introduced": "2.5-dev6"
},
{
"last_affected": "2.5-dev6"
}
]
}
}
],
"versions": [
"2.5-dev0",
"2.5-dev1",
"2.5-dev2",
"2.5-dev3",
"2.5-dev4",
"2.5-dev5",
"2.5-dev6",
"v2.5-dev6",
"v2.5-dev5",
"v2.5-dev4",
"v2.5-dev3",
"v2.5-dev2",
"v2.5-dev1",
"v2.5-dev0",
"v2.4.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-40346.json",
"vanir_signatures": [
{
"id": "CVE-2021-40346-720f56ce",
"digest": {
"length": 397,
"function_hash": "250362322674641590349589051495230156653"
},
"source": "https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95",
"target": {
"file": "include/haproxy/htx.h",
"function": "htx_add_trailer"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-40346-a2320c5c",
"digest": {
"length": 397,
"function_hash": "137971134793007557031146476273999624430"
},
"source": "https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95",
"target": {
"file": "include/haproxy/htx.h",
"function": "htx_add_header"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-40346-ff6b9c62",
"digest": {
"threshold": 0.9,
"line_hashes": [
"103378957073333009210878063361820249918",
"90642999860060403562236023336123966002",
"87325895267160897988184542515128014985",
"258426726845170808120248969356574058873",
"156690178870054102966697089710863666198",
"97589094008776621651354770360189691565"
]
},
"source": "https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95",
"target": {
"file": "include/haproxy/htx.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-03T14:02:10Z"
}
}
]- Related CVEs
- CVE-2021-40346
Source reference:
/id
Publisher severity
high
Source reference: /severity/0/score
- Event
- #75230 · Revision 1
- Added to Heist Feed
- Publisher date