Vulnetix
Try Vulnetix Request Demo
CVE-2019-18277 PUBLISHED

A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).

EPSS 0.97% · 76.5th percentile

Risk Scores

EPSS Score
0.97%
76.5th percentile

Affected Products

VendorProductVersions
Ubuntu:18.04:LTShaproxy1.8.8-1ubuntu0.6, 0, 1.7.9-1ubuntu1
Ubuntu:16.04:LTShaproxy1.5.14-1, 1.5.15-1, 1.6.2-1

Timeline

References

Open in Interactive Console →