vulnerability
Red Hat: CVE-2023-40225: haproxy: Proxy forwards malformed empty Content-Length headers (Multiple Advisories)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 8 | (AV:N/AC:L/Au:N/C:N/I:C/A:N) | Aug 10, 2023 | Mar 6, 2024 | Sep 1, 2025 |
Severity
8
CVSS
(AV:N/AC:L/Au:N/C:N/I:C/A:N)
Published
Aug 10, 2023
Added
Mar 6, 2024
Modified
Sep 1, 2025
Description
HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.
Solutions
no-fix-redhat-rpm-packageredhat-upgrade-haproxyredhat-upgrade-haproxy-debuginforedhat-upgrade-haproxy-debugsource
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.