Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remote attacker may access a path that is restricted by ACL (Access Control List) set on the product. As a result, the attacker may obtain sensitive information.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:1038 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-53008:
    Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy.
    If this vulnerability is exploited,  a remote attacker may access a path that is restricted by ACL (Access     Control List) set on the product. As a result, the attacker may obtain sensitive information.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the haproxy package has been released.

According to the versions of the haproxy package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy.
    If this vulnerability is exploited,  a remote attacker may access a path that is restricted by ACL (Access     Control List) set on the product. As a result, the attacker may obtain sensitive     information.(CVE-2024-53008)

Tenable has extracted the preceding description block directly from the EulerOS haproxy security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy.
    If this vulnerability is exploited, a remote attacker may access a path that is restricted by ACL (Access     Control List) set on the product. As a result, the attacker may obtain sensitive information.
    (CVE-2024-53008)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-791 advisory.

    Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy.
    If this vulnerability is exploited,  a remote attacker may access a path that is restricted by ACL (Access     Control List) set on the product. As a result, the attacker may obtain sensitive information.
    (CVE-2024-53008)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:4390-1 advisory.

    - CVE-2024-53008: Fixed HTTP/3 request smuggling via malformed HTTP headers forwarded to a HTTP/1.1 non-     compliant back-end server (bsc#1233973)

     Other fixes:

    - Update to version 2.8.11

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7133-1 advisory.

    Yuki Mogi discovered that HAProxy incorrectly handled the interpretation of certain HTTP requests. A     remote attacker could possibly use this issue to perform a request smuggling attack and obtain sensitive     information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
239250	TencentOS Server 4: haproxy (TSSA-2024:1038)	Nessus	Tencent Local Security Checks	medium
234494	Photon OS 4.0: Haproxy PHSA-2025-4.0-0781	Nessus	PhotonOS Local Security Checks	medium
232964	EulerOS 2.0 SP12 : haproxy (EulerOS-SA-2025-1298)	Nessus	Huawei Local Security Checks	medium
232963	EulerOS 2.0 SP12 : haproxy (EulerOS-SA-2025-1297)	Nessus	Huawei Local Security Checks	medium
231085	Linux Distros Unpatched Vulnerability : CVE-2024-53008	Nessus	Misc.	medium
213668	Amazon Linux 2023 : haproxy (ALAS2023-2025-791)	Nessus	Amazon Linux Local Security Checks	medium
213309	SUSE SLES15 / openSUSE 15 Security Update : haproxy (SUSE-SU-2024:4390-1)	Nessus	SuSE Local Security Checks	medium
212018	Ubuntu 24.04 LTS : HAProxy vulnerability (USN-7133-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2024-53008

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium