CVE-2021-39241: debian debian_linux
Vulnerability summary
CVE-2021-39241 is a medium (CVSS 5.3) vulnerability in debian debian_linux. EPSS estimates a 1.69% chance of exploitation in the next 30 days, higher than 76.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5 · Related 1Timeline
- 17-08-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. An HTTP method name may contain a space followed by the name of a protected resource. It is possible that a server would interpret this as a request for that protected resource, such as in the "GET /admin? HTTP/1.1 /static/images HTTP/1.1" example.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
1.69%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
-0.08 pp
From 1.77% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Debian2 products
- haproxy< 2.2.16-1
- debian_linuxEOL11.0
Fedoraproject1 product
- fedoraEOL33 | 34
Haproxy1 product
- haproxy≥ 2.0.0, < 2.0.24 | ≥ 2.2.0, < 2.2.16 | ≥ 2.3.0, < 2.3.13 | ≥ 2.4.0, < 2.4.3
Ubuntu1 product
- haproxy< 2.0.13-2ubuntu0.2
4 vendors · 5 products
References
10 links- www.mail-archive.com/haproxy%40formilux.org/msg41041.htmlX Refsource MISC
