CVE-2026-55203
High · 7.5CVSS
7.5
EPSS
0.3%
Published
Jun 18, 2026
CISA due date
—
The record
HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | haproxy | 0 | 3.4.0+git31.fc300e9f2-1.1 |
Related vulnerabilities
- CVE-2026-26081 HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the… Also affects haproxy
- CVE-2026-55204 HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference… Also affects haproxy
- CVE-2026-33555 An issue was discovered in HAProxy before 3.3.6. Also affects haproxy
- CVE-2025-11230 Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a… Also affects haproxy
- CVE-2024-49214 QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows… Also affects haproxy
- CVE-2024-45506 HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a… Also affects haproxy
- CVE-2026-110264 An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before… CWE-190
- CVE-2026-53615 util-linux is a random collection of Linux utilities. CWE-190