CVE-2021-39241: Debian Linux

Medium severity, CVSS 5.3. EPSS: 1.7% chance of exploitation in the next 30 days.

An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. An HTTP method name may contain a space followed by the name of a protected resource. It is possible that a server would interpret this as a request for that protected resource, such as in the "GET /admin? HTTP/1.1 /static/images HTTP/1.1" example.

Affected products

• Debian Debian Linux: version 11.0 only
• Fedoraproject Fedora: version 33 only; version 34 only
• Haproxy Haproxy: from 2.0.0, before 2.0.24 (fixed in 2.0.24); from 2.2.0, before 2.2.16 (fixed in 2.2.16); from 2.3.0, before 2.3.13 (fixed in 2.3.13); from 2.4.0, before 2.4.3 (fixed in 2.4.3)

Published 2021-08-17. Last modified 2026-06-17.