CVE-2023-40225

7.2 highEPSS 2.1%

High (7.2) in haproxy haproxy. EPSS 2.1% chance of exploitation in the next 30 days.

HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.

Severity

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS: 2.1% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
CWE: CWE-444
Published: 2023-08-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

haproxy:haproxy

References

https://cwe.mitre.org/data/definitions/436.html
https://github.com/haproxy/haproxy/commit/6492f1f29d738457ea9f382aca54537f35f9d856
https://github.com/haproxy/haproxy/issues/2237
https://www.haproxy.org/download/2.6/src/CHANGELOG
https://www.haproxy.org/download/2.7/src/CHANGELOG

Check your stack JSON