CVE-2021-39242: Debian Linux

High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days.

An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead to a situation with an attacker-controlled HTTP Host header, because a mismatch between Host and authority is mishandled.

Affected products

• Debian Debian Linux: version 11.0 only
• Fedoraproject Fedora: version 33 only; version 34 only
• Haproxy Haproxy: from 2.2.0, before 2.2.16 (fixed in 2.2.16); from 2.3.0, before 2.3.13 (fixed in 2.3.13); from 2.4.0, before 2.4.3 (fixed in 2.4.3)

Published 2021-08-17. Last modified 2026-06-17.