Improper Handling of Content-Length Header in HAProxy by HAProxy Technologies
CVE-2023-40225
7.2HIGH
What is CVE-2023-40225?
HAProxy versions prior to 2.6.15, and several 2.x versions display a vulnerability in their handling of empty Content-Length headers, which can violate RFC 9110, section 8.6. This misconfiguration allows HTTP/1 servers positioned behind HAProxy to potentially misinterpret the payload as an additional request, leading to undefined behaviors. Administrators are urged to review their HAProxy configurations and upgrade to the latest versions to mitigate this vulnerability.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
References
CVSS V3.1
Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved