HAProxy
HAProxy is a high-availability load balancer and TCP/HTTP proxy, widely deployed as a frontend for application servers and API gateways. It is maintained by its own CNA and self-publishes CVEs to NVD, producing high-quality version range records. CVE history concentrates around HTTP header parsing, request smuggling, and the HPACK decoder used for HTTP/2.
Querying HAProxy
haproxy2.9.0, 2.8.5, 2.6.15curl "https://api.attestd.io/v1/check?product=haproxy&version=2.4.0" \
-H "Authorization: Bearer $ATTESTD_KEY"HAProxy 2.4.0 is affected by CVE-2021-40346 (integer overflow in htx_add_header allowing request smuggling). The aggregated response expects risk_state: "high".
{
"product": "haproxy",
"version": "2.4.0",
"supported": true,
"risk_state": "high",
"risk_factors": [
"request_smuggling",
"internet_exposed_service",
"no_authentication_required",
"patch_available"
],
"actively_exploited": false,
"remote_exploitable": true,
"authentication_required": false,
"patch_available": true,
"fixed_version": "2.4.5",
"confidence": 0.82,
"cve_ids": ["CVE-2021-40346"],
"last_updated": "2026-02-23T18:21:30Z"
}HAProxy 2.9.4 has no known relevant vulnerabilities at the time of the last synthesis run.
curl "https://api.attestd.io/v1/check?product=haproxy&version=2.9.4" \
-H "Authorization: Bearer $ATTESTD_KEY"CVE history
HAProxy vulnerabilities cluster around two subsystems: the HTTP header parser (request smuggling via malformed Transfer-Encoding or Content-Length) and the HTTP/2 HPACK decoder (heap overflows via crafted frame sequences). The HAProxy team's CNA status means CVEs are typically published with complete version range data.
| CVE | Description | Affects | CVSS |
|---|---|---|---|
CVE-2023-45539 | HTTP header value parsing flaw allows header injection via hash character in URI path. | < 2.8.5 | 7.5 |
CVE-2023-40225 | Empty Content-Length header value causes HTTP/1 cache poisoning in responses forwarded to upstream. | < 2.8.2 | 7.5 |
CVE-2021-40346 | Integer overflow in htx_add_header function allows HTTP request smuggling via crafted Content-Length values. | < 2.4.5 | 7.5 |
CVE-2020-11100 | Heap buffer overflow in the HPACK decoder via specially crafted HPACK-encoded data in HTTP/2 frames. | < 2.1.4 | 8.8 |
CVE-2019-18277 | Incomplete URL encoding check allows HTTP request smuggling via Transfer-Encoding header manipulation. | < 2.0.6 | 7.5 |