HAProxy (before 2.7.3): HAProxy's HTTP/1 header parser accepts empty header field names, which can be used to make

Impact

HAProxy's HTTP/1 header parser accepts empty header field names, which can be used to make legitimate headers silently disappear after parsing. An attacker can use this to smuggle requests past access-control rules that were supposed to inspect those headers — bypassing ACLs meant to keep unauthorized traffic away from backend inference/storage services.

Who can reach it

Remote — an attacker sends a crafted HTTP/1 request with an empty header field name to a HAProxy instance doing header-based ACL enforcement.

What to do

Software upgrade to HAProxy 2.7.3 or later, then reload/restart the process. HAProxy typically runs as a software component rather than an appliance, so this is a package upgrade + service restart across whichever hosts run it in front of the cluster; a graceful reload avoids dropping in-flight connections if your HAProxy version supports it.

References