A critical integer overflow vulnerability tracked as CVE-2021-40346 has been identified in HAProxy, an open-source high-availability load balancer proxy for TCP and HTTP-based applications that can spread across multiple servers. This vulnerability is classified as an HTTP Request Smuggling flaw (aka HTTP desynchronization) and could be exploited by an attacker to bypass a system’s Access Control List (ACL), inject hidden HTTP requests allowing for access to sensitive data, as well as the ability to execute arbitrary code. “The attack was made possible by utilizing an integer overflow vulnerability that allowed reaching an unexpected state in HAProxy while parsing an HTTP request — specifically — in the logic that deals with Content-Length headers,” researchers from JFrog Security said in a report published on September 7th. As far as researchers can tell, this flaw has not been exploited in the wild. HAProxy has already mitigated the vulnerability in versions 2.0.25, 2.2.17, 2.3.14 and 2.4.4, and customers are urged to upgrade to one of these versions immediately. If for some reason the service cannot be upgraded, then customers are urged to modify the proxy’s configuration with two snippets of code which are listed in the source article. The Ankura CTAPT will continue to report on interesting yet critical vulnerabilities, giving context to our readers and stakeholders regarding the current cybersecurity environment.