HAProxy (2.2 Through 2.2.16) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/haproxy-2.2-through-2.2.16/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 08 Jul 2026 16:05:12 +0000HAProxy CVE-2021-40346 Integer Overflow Leading to HTTP Request Smuggling and ACL Bypasshttps://feed.craftedsignal.io/briefs/2026-07-haproxy-integer-overflow/Wed, 08 Jul 2026 16:05:12 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-haproxy-integer-overflow/A critical integer overflow vulnerability, CVE-2021-40346, in HAProxy's `htx_add_header()` function allows unauthenticated attackers to bypass access control rules by crafting HTTP requests with specific header name lengths, leading to HTTP request smuggling and unauthorized access to backend paths, for which a public exploit is available.A public exploit has been released detailing CVE-2021-40346, an integer overflow vulnerability in HAProxy, an open-source reverse proxy and load balancer. This critical flaw resides in the htx_add_header() function, which is responsible for storing HTTP headers internally. The vulnerability allows attackers to perform HTTP Request Smuggling and bypass Access Control List (ACL) rules by manipulating the length of HTTP header names. Specifically, by crafting a header name exactly 270 bytes long, an integer overflow occurs, leading HAProxy to misinterpret a forged Content-Length: 0 header. This enables the smuggling of a second, hidden request that bypasses HAProxy's initial ACL checks and is delivered to the backend server. The presence of a public Proof-of-Concept (PoC) significantly elevates the risk for unpatched HAProxy installations, particularly versions 2.0 through 2.5 (dev6).

Attack Chain

  1. The attacker crafts an HTTP POST request targeting the HAProxy instance.
  2. Within this request, a specially designed header name, such as Content-Length0 followed by 255 'a' characters (totaling 270 bytes), is included.
  3. HAProxy's htx_add_header() function attempts to store this header name, which exceeds the capacity of its 8-bit length field.
  4. An integer overflow occurs, causing HAProxy to misinterpret the manipulated header as a valid Content-Length: 0.
  5. Following this forged header, the attacker appends a legitimate Content-Length header corresponding to the size of a hidden, malicious HTTP request (e.g., GET /admin HTTP/1.1).
  6. HAProxy proceeds to read the entire client-provided body, including the hidden request, but its internal logic has been poisoned by the Content-Length: 0 interpretation.
  7. When forwarding to the backend, HAProxy's ACLs, configured to inspect only the initial request line, do not detect the smuggled request.
  8. The backend server, having received a Content-Length: 0 for the initial request, then processes the subsequent hidden data (e.g., GET /admin) as a completely new, unauthorized request, effectively bypassing HAProxy's http-request ACLs and gaining access to restricted paths.

Impact

The successful exploitation of CVE-2021-40346 leads to significant security breaches, primarily unauthorized access to restricted backend services and administrative interfaces (e.g., /admin). Organizations leveraging HAProxy as a reverse proxy or load balancer with http-request based ACLs are at risk. This vulnerability could allow attackers to bypass critical security controls designed to segregate network traffic or protect sensitive application endpoints. Depending on the backend application's functionality, this bypass could lead to further compromise, such as privilege escalation, data exfiltration, or complete system takeover. The availability of a public exploit increases the likelihood of widespread attacks against vulnerable systems.

Recommendation

  • Immediately upgrade HAProxy installations to patched versions: 2.0.25, 2.2.17, 2.3.14, 2.4.4, or newer, to remediate CVE-2021-40346.
  • Implement defense-in-depth measures by ensuring backend applications have their own robust authentication and authorization logic, rather than solely relying on proxy ACLs.
]]>highadvisoryinteger-overflowhttp-smugglingacl-bypasshaproxywebserver