Debian/haproxy: critical 9.1
HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty
Action: Upgrade haproxy to 2.6.8-2 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.6.8-2 | - |
Fixed versions
| 2.6.8-2 |
Sources
- osv: DEBIAN-CVE-2023-25725#Debian:14/haproxy
- https://security-tracker.debian.org/tracker/CVE-2023-25725
published · modified · JSON