CVE-2019-18277 Other in n/a
Attackers can exploit HTTP request smuggling in HAProxy legacy mode with specific reuse settings to bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-18277?
CVE-2019-18277 is a high-severity vulnerability in n/a, published on 23 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).
Weakness: CWE-444
Which versions are affected by CVE-2019-18277?
It affects 1 product.
Linux distribution packages (13)
haproxy SUSE:HPE Helion OpenStack 8 | All versions | 1.6.11-11.3.1 |
haproxy SUSE:Linux Enterprise High Availability Extension 12 SP3 | All versions | 1.6.11-11.3.1 |
haproxy SUSE:Linux Enterprise High Availability Extension 12 SP4 | All versions | 1.6.11-11.3.1 |
haproxy SUSE:Linux Enterprise High Availability Extension 12 SP5 | All versions | 1.6.11-11.3.1 |
haproxy SUSE:Linux Enterprise High Availability Extension 15 | All versions | 2.0.10+git0.ac198b92-3.15.1 |
haproxy SUSE:Linux Enterprise High Availability Extension 15 SP1 | All versions | 2.0.10+git0.ac198b92-8.8.1 |
haproxy SUSE:OpenStack Cloud 7 | All versions | 1.6.11-11.3.1 |
haproxy SUSE:OpenStack Cloud 8 | All versions | 1.6.11-11.3.1 |
haproxy SUSE:OpenStack Cloud 9 | All versions | 1.6.11-11.3.1 |
haproxy SUSE:OpenStack Cloud Crowbar 8 | All versions | 1.6.11-11.3.1 |
haproxy SUSE:OpenStack Cloud Crowbar 9 | All versions | 1.6.11-11.3.1 |
haproxy openSUSE:Leap 15.0 | All versions | 2.0.10+git0.ac198b92-lp150.2.16.1 |
haproxy openSUSE:Leap 15.1 | All versions | 2.0.10+git0.ac198b92-lp151.2.6.1 |
Products include Haproxy Haproxy.
How do I fix CVE-2019-18277?
Upgrade to a fixed version.
Is CVE-2019-18277 being exploited?
There is no known exploitation of CVE-2019-18277 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as CLSA-2026-1776336742, CLSA-2026-1776337242, DEBIAN-CVE-2019-18277, GHSA-7r84-r685-grmg, SUSE-SU-2019:3125-1, SUSE-SU-2019:3126-1 and 5 more.