onyx --cves cve-2023-25950

CVE-2023-25950

score: <0.1
cvss: 7.3
epss: 3.0%
published: 2023-04-11
kev added: —
first seen: 2026-10-21

HAProxy 2.7.0 and 2.6.1 to 2.6.7 contain an HTTP request/response smuggling vulnerability caused by improper request parsing, letting remote attackers alter legitimate user requests, exploit requires sending crafted HTTP requests.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

2023-04-11 Published
2026-10-21 Tracked by Onyx
2026-10-21 Public PoC

Exploit availability

Public PoC flagged by vulnx; no direct exploit link among the citations.

Weaknesses

CWE-444

References 3

https://www.haproxy.org/
https://jvn.jp/en/jp/JVN38170084/
https://git.haproxy.org/?p=haproxy-2.7.git%3Ba=commit%3Bh=3ca4223c5e1f18a19dc93b0b09ffdbd295554d46