CVE-2021-39240: Debian Linux

High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days.

An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve.

Affected products

• Debian Debian Linux: version 11.0 only
• Fedoraproject Fedora: version 33 only; version 34 only
• Haproxy Haproxy: from 2.2.0, before 2.2.16 (fixed in 2.2.16); from 2.3.0, before 2.3.13 (fixed in 2.3.13); from 2.4.0, before 2.4.3 (fixed in 2.4.3)

Published 2021-08-17. Last modified 2026-06-17.