writeups.xyz / http: properly reject empty http header field names

Submitter : c2a

Date: 14 February 2023

Bounty : undisclosed

Vulnerabilities :

• HTTP Header Attack
• HTTP Request Smuggling
• Access Control Bypass

Programs :

• HAProxy

Authors :

• Bahruz Jabiyev (@BahruzJabiyev)
• Anthony Gavazzi
• Engin Kirda
• Kaan Onarlioglu
• Adi Peleg
• Harvey Tuch

Link :
https://github.com/haproxy/haproxy/commit/a8598a2eb11b6c989e81f0dbf10be361782e8d32