Is HAProxy 2.3.21 affected?

CVSS 9.1

4 known vulnerabilities affect 2.3.21 (highest CVSS 9.1).

Your branch 2.3 has reached end of life (Jul 27, 2022).

27 newer releases in its track, up to 3.4.7. What changed up to 3.4.7

Vulnerabilities affecting 2.3.21

9.1
CVE-2023-25725 HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept em… fixed in 2.4.22
8.2
CVE-2023-45539 HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end… fixed in 2.8.2
7.5
CVE-2026-55203 HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When conten… fixed in 2.4.36
7.5
CVE-2026-55204 HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_… fixed in 2.4.36