$ cve CVE-2023-25725 JSON

CVE-2023-25725

9.1

CRITICAL · CVSS 3.1 · EPSS 5.4% (pctl 93)

In your normal cycle

Critical by CVSS (9.1), but no sign of active exploitation.

Description

HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3, the impact is limited because the headers disappear before being parsed and processed, as if they had not been sent by the client. The fixed versions are 2.7.3, 2.6.9, 2.5.12, 2.4.22, 2.2.29, and 2.0.31.

Scoring

CVSS	9.1 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS	5.45% — more likely to be exploited than 93% of all CVEs
Weakness	CWE-444
On CISA KEV	no
Public exploit	none known
Published	2023-02-14
Last modified	2026-06-17

Affected (2)

Vendor	Product
debian	debian linux
haproxy	haproxy

References

→ the Explorer · watch your stack · NVD