CVE-2021-40346: Debian Linux

High severity, CVSS 7.5. EPSS: 58.8% chance of exploitation in the next 30 days.

An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.

Affected products

• Debian Debian Linux: version 11.0 only
• Fedoraproject Fedora: version 33 only; version 34 only
• Haproxy Haproxy: from 2.0.0, before 2.0.25 (fixed in 2.0.25); from 2.2.0, before 2.2.17 (fixed in 2.2.17); from 2.3.0, before 2.3.14 (fixed in 2.3.14); from 2.4.0, before 2.4.4 (fixed in 2.4.4); version 2.5 only

Published 2021-09-08. Last modified 2026-06-17.