cve/2021/CVE-2021-40346.md

### [CVE-2021-40346](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40346)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/BLACKHAT-SSG/Awesome-HTTPRequestSmuggling
- https://github.com/CHYbeta/OddProxyDemo
- https://github.com/D4rkP0w4r/INTENT-CTF-2021
- https://github.com/NaInSec/CVE-PoC-in-GitHub
- https://github.com/PwnAwan/Awesome-HTTPRequestSmuggling
- https://github.com/SYRTI/POC_to_review
- https://github.com/Vulnmachines/HAProxy_CVE-2021-40346
- https://github.com/WhooAmii/POC_to_review
- https://github.com/alexOarga/CVE-2021-40346
- https://github.com/alikarimi999/CVE-2021-40346
- https://github.com/chenjj/Awesome-HTTPRequestSmuggling
- https://github.com/donky16/CVE-2021-40346-POC
- https://github.com/izj007/wechat
- https://github.com/knqyf263/CVE-2021-40346
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/rizemon/CS5331
- https://github.com/soosmile/POC
- https://github.com/taielab/awesome-hacking-lists
- https://github.com/trhacknon/Pocingit
- https://github.com/whoami13apt/files2
- https://github.com/zecool/cve