CVE-2021-40346

HIGH LAB

HAProxy <2.6 - HTTP Request Smuggling

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 5 public exploits for CVE-2021-40346. PoCs published by knqyf263, donky16, Vulnmachines.

AI-analyzed exploit summary This repository contains a proof-of-concept for CVE-2021-40346, an HTTP request smuggling vulnerability in HAProxy. The PoC demonstrates how an attacker can bypass access controls (e.g., `/admin` endpoint) by exploiting inconsistent handling of HTTP headers.

Description

An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.

Exploits (5)

nomisec WORKING POC 41 stars
by knqyf263 · poc
https://github.com/knqyf263/CVE-2021-40346

This repository contains a proof-of-concept for CVE-2021-40346, an HTTP request smuggling vulnerability in HAProxy. The PoC demonstrates how an attacker can bypass access controls (e.g., `/admin` endpoint) by exploiting inconsistent handling of HTTP headers.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: HAProxy (versions affected by CVE-2021-40346)
No auth needed
Prerequisites: Docker for setup · HAProxy configured with vulnerable settings
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec STUB 32 stars
by donky16 · poc
https://github.com/donky16/CVE-2021-40346-POC

The repository claims to be a PoC for CVE-2021-40346 (HAProxy integer overflow leading to HTTP request smuggling) but only contains a basic Flask app with no exploit logic. The README references external analysis but lacks functional exploit code.

Classification
Stub 80%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: HAProxy (version not specified)
No auth needed
Prerequisites: HAProxy instance vulnerable to CVE-2021-40346
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP 5 stars
by Vulnmachines · poc
https://github.com/Vulnmachines/HAProxy_CVE-2021-40346

This repository contains a writeup and references for CVE-2021-40346, an integer overflow vulnerability in HAProxy that enables HTTP smuggling. It provides links to external resources but does not include exploit code or technical details.

Classification
Writeup 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: HAProxy (versions affected by CVE-2021-40346)
No auth needed
Prerequisites: HAProxy instance vulnerable to CVE-2021-40346
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 5 stars
by alikarimi999 · poc
https://github.com/alikarimi999/CVE-2021-40346

This repository contains a Python-based exploit for CVE-2021-40346, a vulnerability in HAProxy that allows HTTP request smuggling. The exploit crafts a malicious HTTP request to bypass access controls and retrieve forbidden resources.

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: HAProxy (versions affected by CVE-2021-40346)
No auth needed
Prerequisites: Network access to the target HAProxy instance · Knowledge of forbidden paths or resources
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by BoianEduard · poc
https://github.com/BoianEduard/CVE-2021-40346

This PoC demonstrates CVE-2021-40346, an integer overflow vulnerability in HAProxy that enables HTTP request smuggling to bypass ACLs. The exploit uses a crafted header to trigger an overflow, allowing an attacker to smuggle a request to a protected endpoint.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: HAProxy (versions affected by CVE-2021-40346)
No auth needed
Prerequisites: HAProxy with vulnerable configuration · Network access to the target HAProxy instance
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Scores

CVSS v3 7.5
EPSS 0.9238
EPSS Percentile 99.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Lab Environment

COMMUNITY
Community Lab
docker pull alikarimi999/cve-2021-40346
+3 more repos

Details

CWE
CWE-190
Status published
Products (5)
debian/debian_linux 11.0
fedoraproject/fedora 33
fedoraproject/fedora 34
haproxy/haproxy 2.5 dev0 (7 CPE variants)
haproxy/haproxy 2.0.0 - 2.0.25
Published Sep 08, 2021
Tracked Since Feb 18, 2026