Skip to content
Fencer Vulns
medium 4.0

CVE-2026-33555 json

An issue was discovered in HAProxy before 3.3.6.

published 2026-04-13 6 mo ago modified 2026-10-19 21 d ago also BIT-haproxy-2026-33555 , EUVD-2026-21997

cvss
4.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits
0
none known

Summary

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

Patch / fix

  • bitnami haproxy 3.3.6
  • HAProxy HAProxy 3.3.6
  • haproxy Debian 12 2.6.12-1+deb12u4
  • haproxy Debian 13 3.0.11-1+deb13u3
  • haproxy Debian 14 3.2.15-1

debian advisories DEBIAN-CVE-2026-33555

  • haproxy Ubuntu 24.04 LTS 2.8.16-0ubuntu0.24.04.2
  • haproxy Ubuntu 25.10 3.0.12-0ubuntu0.25.10.4
  • haproxy Ubuntu 26.04 LTS 3.2.9-1ubuntu2.1

ubuntu advisories UBUNTU-CVE-2026-33555

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • haproxy hummingbird 1 3.0.19-1.1.hum1

red hat advisories RHSA-2026:8749

  • haproxy SLE High Availability Extension 15 SP7, SLE High Availability Extension 15 SP6 2.8.11+git0.01c1056a4-150600.3.12.1
  • haproxy Linux Micro 6.2 3.2.15+git64.0fc44b458-160000.2.1

suse advisories SUSE-SU-2026:1568-1SUSE-SU-2026:21280-1

  • haproxy openSUSE Leap 16.0 3.2.15+git64.0fc44b458-160000.2.1
  • haproxy openSUSE Tumbleweed 3.3.6+git91.af5637e93-1.1

opensuse advisories openSUSE-SU-2026:20618-1openSUSE-SU-2026:10581-1

  • haproxy Azure Linux 3.0 2.9.11-5

azure linux advisories AZL-82730

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-33555 updated cvss 4.0

haproxy: HAProxy: Request smuggling via HTTP/3 parser desynchronization

  • Red Hat Enterprise Linux 9 haproxy Red Hat Enterprise Linux 10 haproxy Red Hat OpenShift Container Platform 4 haproxy, haproxy18, haproxy20, haproxy22, haproxy26, haproxy28
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images haproxy 3.0.19-1.1.hum1
    fixed: vendor fix RHSA-2026:8749
  • Red Hat Enterprise Linux 7 haproxy Red Hat Enterprise Linux 8 haproxy
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.31% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • r3verii.github.io https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 4.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
NVD 3.1 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
OSV 3.1 4.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
bitnami haproxy
>=2.6.0, <3.3.6
3.3.6

Affected products

  • HAProxy HAProxy

Classification

Weakness
  • CWE-130 Improper Handling of Length Parameter Inconsistency

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.