CVE-2021-39240

An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve.

• https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=4b8852c70d8c4b7e225e24eb58258a15eb54c26e
• https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=a495e0d94876c9d39763db319f609351907a31e8
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ALECUZDIMT5FYGP6V6PVSI4BKVZTZWN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RPNY4WZIQUAUOCLIMUPC37AQWNXTWIQM/
• https://www.debian.org/security/2021/dsa-4960Third Party Advisory
• https://www.mail-archive.com/haproxy%40formilux.org/msg41041.html
• https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=4b8852c70d8c4b7e225e24eb58258a15eb54c26e
• https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=a495e0d94876c9d39763db319f609351907a31e8
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ALECUZDIMT5FYGP6V6PVSI4BKVZTZWN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RPNY4WZIQUAUOCLIMUPC37AQWNXTWIQM/
• https://www.debian.org/security/2021/dsa-4960Third Party Advisory
• https://www.mail-archive.com/haproxy%40formilux.org/msg41041.html

Published

Aug 17, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39235In Apache Ozone before 1.2.0, Ozone Datanode doesn't check t…6.5
• CVE-2021-39236In Apache Ozone before 1.2.0, Authenticated users with valid…8.8
• CVE-2021-39237Certain HP LaserJet, HP LaserJet Managed, HP PageWide, and H…4.6
• CVE-2021-39238Certain HP Enterprise LaserJet, HP LaserJet Managed, HP Ente…9.8
• CVE-2021-39239A vulnerability in XML processing in Apache Jena, in version…7.5
• CVE-2021-3924grav is vulnerable to Improper Limitation of a Pathname to a…7.5
• CVE-2021-39241An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 be…5.3
• CVE-2021-39242An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 be…7.5
• CVE-2021-39243Cross-Site Request Forgery (CSRF) exists on Altus Nexto, Nex…6.5
• CVE-2021-39244Authenticated Semi-Blind Command Injection (via Parameter In…8.8
• CVE-2021-39245Hardcoded .htaccess Credentials for getlogs.cgi exist on Alt…7.5
• CVE-2021-39246Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a …6.1