CVE-2021-39240: debian debian_linux
Vulnerability summary
CVE-2021-39240 is a high (CVSS 7.5) vulnerability in debian debian_linux. EPSS estimates a 2.21% chance of exploitation in the next 30 days, higher than 82.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 4 · Related 1Timeline
- 17-08-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
2.21%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
-0.11 pp
From 2.32% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Debian2 products
- haproxy< 2.2.16-1
- debian_linuxEOL11.0
Fedoraproject1 product
- fedoraEOL33 | 34
Haproxy1 product
- haproxy≥ 2.2.0, < 2.2.16 | ≥ 2.3.0, < 2.3.13 | ≥ 2.4.0, < 2.4.3
3 vendors · 4 products
References
7 links- www.mail-archive.com/haproxy%40formilux.org/msg41041.htmlX Refsource MISC
