CVE-2019-18277

A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).

• CWE-444

• http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00016.html
• http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00019.html
• https://git.haproxy.org/?p=haproxy-2.0.git%3Ba=commit%3Bh=196a7df44d8129d1adc795da020b722614d6a581
• https://lists.debian.org/debian-lts-announce/2022/05/msg00045.html
• https://nathandavison.com/blog/haproxy-http-request-smugglingExploit, Third Party Advisory
• https://usn.ubuntu.com/4174-1/
• https://www.mail-archive.com/haproxy%40formilux.org/msg34926.html
• http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00016.html
• http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00019.html
• https://git.haproxy.org/?p=haproxy-2.0.git%3Ba=commit%3Bh=196a7df44d8129d1adc795da020b722614d6a581
• https://lists.debian.org/debian-lts-announce/2022/05/msg00045.html
• https://nathandavison.com/blog/haproxy-http-request-smugglingExploit, Third Party Advisory
• https://usn.ubuntu.com/4174-1/
• https://www.mail-archive.com/haproxy%40formilux.org/msg34926.html

Published

Oct 23, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18269Omron’s CS and CJ series PLCs have an unrestricted externall…9.8
• CVE-2019-1827A vulnerability in the Online Help web service of Cisco Smal…6.1
• CVE-2019-18271OSIsoft PI Vision, All versions of PI Vision prior to 2019. …8.8
• CVE-2019-18273OSIsoft PI Vision, PI Vision 2017 R2 and PI Vision 2017 R2 S…4.8
• CVE-2019-18275OSIsoft PI Vision, All versions of PI Vision prior to 2019. …6.5
• CVE-2019-18276An issue was discovered in disable_priv_mode in shell.c in G…7.8
• CVE-2019-18278When executing VideoLAN VLC media player 3.0.8 with libqt on…7.8
• CVE-2019-18279In Phoenix SCT WinFlash 1.1.12.0 through 1.5.74.0, the inclu…8.8
• CVE-2019-1828A vulnerability in the web-based management interface of Cis…5.9
• CVE-2019-18280Sourcecodester Online Grading System 1.0 is affected by a Cr…8.8
• CVE-2019-18281An out-of-bounds memory access in the generateDirectionalRun…4.3
• CVE-2019-18282The flow_dissector feature in the Linux kernel 4.3 through 5…5.3