Collected research

Integer overflow vulnerability in HAProxy

Critical Vulnerability in HAProxy (CVE-2021-40346): Integer Overflow Enables HTTP Smuggling

daniellea, @jfrog and Ori Hollander and Or Peles · JFrog · 7 September 2021

HAProxy stored an HTTP header's name length in only 8 bits, so a 270-byte header name overflowed the field and the second processing phase read a different, shorter name than the parsing phase did. A crafted request thereby gains a second Content-Length that HAProxy forwards, letting an attacker smuggle a whole request past HAProxy's ACLs to the backend.

Record

Document

Critical Vulnerability in HAProxy (CVE-2021-40346): Integer Overflow Enables HTTP Smuggling

Researcher

daniellea, @jfrog and Ori Hollander and Or Peles

Published by

JFrog

Date

7 September 2021

Topic

Other

In the archive

• Collected in the 2021 research round

Tags

• request-smuggling
• smuggling
• waf-bypass
• auth-bypass
• http
• load-balancer
• reverse-proxy
• cve
• parser-differential
• owasp-a01-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of daniellea, @jfrog and Ori Hollander and Or Peles, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.