CVE-2023-25725

Deeper analysis

HAProxy versions prior to 2.7.3 are affected by a request smuggling vulnerability that stems from the HTTP/1 header parser accepting empty header field names. This behavior can truncate the list of headers during parsing and processing for HTTP/1.0 and HTTP/1.1 requests, causing selected headers to be lost after initial handling. The same root cause produces more limited effects under HTTP/2 and HTTP/3 because the headers are dropped before they reach the processing stage. Fixed releases are listed as 2.7.3, 2.6.9, 2.5.12, 2.4.22, 2.2.29, and 2.0.31.

An unauthenticated network attacker can craft requests containing empty header names to strip subsequent headers, thereby bypassing access-control checks or other header-dependent policies enforced by HAProxy. The resulting integrity and availability impact is rated high under CVSS 9.1, reflecting the potential for unauthorized actions or service disruption without requiring user interaction.

Advisories from Debian and Fedora, along with the upstream commit, direct users to apply the listed patched versions. The references also include distribution-specific announcements that document the coordinated rollout of these updates.

EPSS for the CVE rose from lower values to a peak of 0.2994 before receding to the current 0.1754, indicating a period of increased exploitation interest after disclosure. No confirmed in-the-wild campaigns are described in the supplied references.