HTTP Request/Response Smuggling Vulnerability in HAProxy by HAProxy Technologies
CVE-2023-25950
7.3HIGH
Key Information:
- Vendor
Haproxy Technologies
- Status
- Vendor
- CVE Published:
- 11 April 2023
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2023-25950?
An HTTP request/response smuggling vulnerability exists in HAProxy versions 2.6.1 through 2.6.7 and 2.7.0. This flaw enables remote attackers to manipulate legitimate user requests, potentially leading to unauthorized information disclosure or a denial-of-service (DoS) condition. Effective security measures should be implemented to mitigate the risk associated with this vulnerability.
Affected Version(s)
HAProxy version 2.7.0, and version 2.6.1 to 2.6.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.