CVE-2021-39241

An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. An HTTP method name may contain a space followed by the name of a protected resource. It is possible that a server would interpret this as a request for that protected resource, such as in the "GET /admin? HTTP/1.1 /static/images HTTP/1.1" example.

• https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=89265224d314a056d77d974284802c1b8a0dc97f
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ALECUZDIMT5FYGP6V6PVSI4BKVZTZWN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RPNY4WZIQUAUOCLIMUPC37AQWNXTWIQM/
• https://www.debian.org/security/2021/dsa-4960Third Party Advisory
• https://www.mail-archive.com/haproxy%40formilux.org/msg41041.html
• https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=89265224d314a056d77d974284802c1b8a0dc97f
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ALECUZDIMT5FYGP6V6PVSI4BKVZTZWN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RPNY4WZIQUAUOCLIMUPC37AQWNXTWIQM/
• https://www.debian.org/security/2021/dsa-4960Third Party Advisory
• https://www.mail-archive.com/haproxy%40formilux.org/msg41041.html

Published

Aug 17, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39236In Apache Ozone before 1.2.0, Authenticated users with valid…8.8
• CVE-2021-39237Certain HP LaserJet, HP LaserJet Managed, HP PageWide, and H…4.6
• CVE-2021-39238Certain HP Enterprise LaserJet, HP LaserJet Managed, HP Ente…9.8
• CVE-2021-39239A vulnerability in XML processing in Apache Jena, in version…7.5
• CVE-2021-3924grav is vulnerable to Improper Limitation of a Pathname to a…7.5
• CVE-2021-39240An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 be…7.5
• CVE-2021-39242An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 be…7.5
• CVE-2021-39243Cross-Site Request Forgery (CSRF) exists on Altus Nexto, Nex…6.5
• CVE-2021-39244Authenticated Semi-Blind Command Injection (via Parameter In…8.8
• CVE-2021-39245Hardcoded .htaccess Credentials for getlogs.cgi exist on Alt…7.5
• CVE-2021-39246Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a …6.1
• CVE-2021-39247Zint Barcode Generator before 2.10.0 has a one-byte buffer o…6.5