{
  "cveId": "CVE-2023-25725",
  "url": "https://patchblox.com/security/cve/CVE-2023-25725",
  "summary": "CVE-2023-25725 is fixed in 2 products on 1 platform, first by haproxy 1.8.8-1ubuntu0.13, released February 14, 2023. It is not reported as exploited. Patch Radar priority: High.",
  "title": "haproxy: HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1headers are inadvertently lost in some situat...",
  "description": "HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1headers are inadvertently lost in some situations, aka \u0022request smuggling.\u0022The HTTP header parsers in HAProxy may accept empty header field names,which could be used to truncate the list of HTTP headers and thus make someheaders disappear after being parsed and processed for HTTP/1.0 andHTTP/1.1. For HTTP/2 and HTTP/3, the impact is limited because the headersdisappear before being parsed and processed, as if they had not been sentby the client. The fixed versions are 2.7.3, 2.6.9, 2.5.12, 2.4.22, 2.2.29,and 2.0.31.",
  "published": "2023-02-14T08:00:00Z",
  "severity": "Medium",
  "cvss": 9.1,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
  "epss": 0.05493,
  "epssPercentile": 0.92833,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "haproxy",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "2.6.8-2",
      "fix": "DEBIAN-CVE-2023-25725",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-25725",
      "released": "2023-02-14T19:15:11Z"
    },
    {
      "platform": "linux",
      "product": "haproxy",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2.6.8-2",
      "fix": "DEBIAN-CVE-2023-25725",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-25725",
      "released": "2023-02-14T19:15:11Z"
    },
    {
      "platform": "linux",
      "product": "haproxy",
      "release": "Debian 14",
      "fixedVersion": "2.6.8-2",
      "fix": "DEBIAN-CVE-2023-25725",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-25725",
      "released": "2023-02-14T19:15:11Z"
    },
    {
      "platform": "linux",
      "product": "haproxy",
      "release": "RHEL 9",
      "fixedVersion": "0:2.4.17-3.el9_1.2",
      "fix": "RHSA-2023:1696",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2023-1696",
      "released": "2023-04-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "haproxy",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1.8.8-1ubuntu0.13",
      "fix": "haproxy 1.8.8-1ubuntu0.13",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-haproxy-1.8.8-1ubuntu0.13",
      "released": "2023-02-14T08:00:00Z"
    },
    {
      "platform": "linux",
      "product": "haproxy",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2.0.29-0ubuntu1.3",
      "fix": "haproxy 2.0.29-0ubuntu1.3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-haproxy-2.0.29-0ubuntu1.3",
      "released": "2023-02-14T08:00:00Z"
    },
    {
      "platform": "linux",
      "product": "haproxy",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2.4.18-0ubuntu1.2",
      "fix": "haproxy 2.4.18-0ubuntu1.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-haproxy-2.4.18-0ubuntu1.2",
      "released": "2023-02-14T08:00:00Z"
    },
    {
      "platform": "linux",
      "product": "haproxy",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "2.6.9-1ubuntu1",
      "fix": "haproxy 2.6.9-1ubuntu1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-haproxy-2.6.9-1ubuntu1",
      "released": "2026-01-16T01:42:23Z"
    },
    {
      "platform": "linux",
      "product": "haproxy",
      "release": "almalinux 9",
      "fixedVersion": "2.4.17-3.el9_1.2",
      "fix": "ALSA-2023:1696",
      "url": "https://patchblox.com/security/fix/linux/alsa-2023-1696",
      "released": "2023-04-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "haproxy",
      "release": "ol 9",
      "fixedVersion": "0:2.4.17-3.el9_1.2",
      "fix": "ELSA-2023-1696",
      "url": "https://patchblox.com/security/fix/linux/elsa-2023-1696",
      "released": "2023-04-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "vim-haproxy",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1.8.8-1ubuntu0.13",
      "fix": "vim-haproxy 1.8.8-1ubuntu0.13",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-vim-haproxy-1.8.8-1ubuntu0.13",
      "released": "2023-02-14T08:00:00Z"
    },
    {
      "platform": "linux",
      "product": "vim-haproxy",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2.0.29-0ubuntu1.3",
      "fix": "vim-haproxy 2.0.29-0ubuntu1.3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-vim-haproxy-2.0.29-0ubuntu1.3",
      "released": "2023-02-14T08:00:00Z"
    },
    {
      "platform": "linux",
      "product": "vim-haproxy",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2.4.18-0ubuntu1.2",
      "fix": "vim-haproxy 2.4.18-0ubuntu1.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-vim-haproxy-2.4.18-0ubuntu1.2",
      "released": "2023-02-14T08:00:00Z"
    },
    {
      "platform": "linux",
      "product": "vim-haproxy",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "2.6.9-1ubuntu1",
      "fix": "vim-haproxy 2.6.9-1ubuntu1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-vim-haproxy-2.6.9-1ubuntu1",
      "released": "2026-01-16T01:42:23Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}