CVE-2021-39240

Name of the Vulnerable Software and Affected Versions HAProxy versions 2.2 through 2.2.15 HAProxy versions 2.3 through 2.3.12 HAProxy versions 2.4 through 2.4.2

Description An issue was discovered in HAProxy where it does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field might differ from what the routing rules were intended to achieve, potentially allowing a remote attacker to access confidential data due to insufficient input validation.

Recommendations For HAProxy versions 2.2 through 2.2.15, update to version 2.2.16 or later. For HAProxy versions 2.3 through 2.3.12, update to version 2.3.13 or later. For HAProxy versions 2.4 through 2.4.2, update to version 2.4.3 or later.