CVE-2023-40225

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-444

Affected software

No affected versions have been published.

Timeline

Published: Aug 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-40234.3The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users mes CVE-2023-402356.5An NTLM Hash Disclosure was discovered in ArchiMate Archi before 5.1.0. When parsing the XMLNS value of an ArchiMate project file, if the na CVE-2023-402365.3In Pexip VMR self-service portal before 3, the same SSH host key is used across different customers' installations, which allows authenticat CVE-2023-402385.5A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.CVE-2023-402397.5Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure. The fixed firmware version i CVE-2023-40245.3The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_pla CVE-2023-40255.3The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_pla CVE-2023-402508.8Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Hancom HCell on Windows allows Overflow Buffers.This CVE-2023-402515.9Missing Encryption of Sensitive Data vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genia CVE-2023-402529.8Improper Control of Generation of Code ('Code Injection') vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian CVE-2023-402539.8Improper Authentication vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTN CVE-2023-402549.8Download of Code Without Integrity Check vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, G