CVE-2023-40225

A flaw was found in HAProxy. Empty Content-Length headers are forwarded, which could cause an HTTP/1 server behind it to interpret the payload as an extra request. This may render the HTTP/1 server vulnerable to attacks in some uncommon cases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This flaw can be mitigated by applying a rule to explicitly reject any requests with an empty Content-Lenght header. The following line can be added to any frontend configurations at the /etc/haproxy/haproxy.cfg file.

http-request deny if { hdr_len(content-length) 0 }