Skip to content
Fencer Vulns
high 7.5

CVE-2026-55203 json

HAProxy - Integer Overflow in FCGI Demux Record Length Field

published 2026-06-18 4 mo ago modified 2026-10-26 14 d ago also BIT-haproxy-2026-55203 , EUVD-2026-37905

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 26%
public exploits
0
none known

Summary

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

Patch / fix

  • bitnami haproxy 2.4.36, 2.6.30, 2.8.25, 3.0.24, 3.2.20, 3.4.1
  • haproxy haproxy 2.4.36, 2.6.30, 2.8.25, 3.0.24, 3.2.20, 3.4.1
  • haproxy Debian 14 3.2.20-1

debian advisories DEBIAN-CVE-2026-55203

  • haproxy Ubuntu 22.04 LTS 2.4.30-0ubuntu0.22.04.2
  • haproxy Ubuntu 24.04 LTS 2.8.16-0ubuntu0.24.04.3
  • haproxy Ubuntu 25.10 3.0.12-0ubuntu0.25.10.5
  • haproxy Ubuntu 26.04 LTS 3.2.9-1ubuntu2.2

ubuntu advisories UBUNTU-CVE-2026-55203

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • haproxy RHEL 9 2.8.14-3.el9_8.2
  • haproxy RHEL 10.2 3.0.5-6.el10_2.2
  • haproxy hummingbird 1 3.0.25-0.1.hum1
  • haproxy RHEL 9.6 EUS 2.4.22-4.el9_6.3
  • haproxy RHEL 9.4 E4S 2.4.22-3.el9_4.3
  • haproxy RHEL 9.2 E4S 2.4.17-6.el9_2.5
  • haproxy enterprise linux eus 10.0 3.0.5-4.el10_0.3

red hat advisories RHSA-2026:55803RHSA-2026:55801RHSA-2026:55802RHSA-2026:55800RHSA-2026:55772RHSA-2026:55679

  • haproxy SLE High Availability Extension 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 3.2.21+git0.dbe43be37-160000.1.1
  • haproxy Linux Micro 6.0 2.8.11+git0.01c1056a4-4.1
  • haproxy Linux Micro 6.1 2.8.11+git0.01c1056a4-slfo.1.1_4.1
  • haproxy SLE High Availability Extension 15 SP7, SLE High Availability Extension 15 SP6 2.8.11+git0.01c1056a4-150600.3.15.1
  • haproxy SLE Micro 5.5, SLE Micro 5.4, SLE Micro 5.3 +2 more 2.4.22+git0.f8e3218e2-150400.3.28.1

suse advisories SUSE-SU-2026:22557-1SUSE-SU-2026:22544-1SUSE-SU-2026:22587-1SUSE-SU-2026:22515-1SUSE-SU-2026:22663-1SUSE-SU-2026:2652-1

  • haproxy openSUSE Leap 16.0 3.2.21+git0.dbe43be37-160000.1.1
  • haproxy openSUSE Tumbleweed 3.4.0+git31.fc300e9f2-1.1

opensuse advisories openSUSE-SU-2026:21245-1openSUSE-SU-2026:11090-1

  • haproxy AlmaLinux 10 3.0.5-6.el10_2.2
  • haproxy AlmaLinux 9 2.8.14-3.el9_8.2

almalinux advisories ALSA-2026:55679ALSA-2026:55772

  • haproxy Rocky Linux 10 3.0.5-6.el10_2.2
  • haproxy Rocky Linux 9 2.8.14-3.el9_8.2

rocky linux advisories RLSA-2026:55679RLSA-2026:55772

  • haproxy Azure Linux 3.0 2.9.11-7

azure linux advisories AZL-90264

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-55203 updated cvss 7.5

haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling

  • Red Hat Ceph Storage 5 rhceph/rhceph-haproxy-rhel8 Red Hat Ceph Storage 6 rhceph/rhceph-haproxy-rhel9 Red Hat Ceph Storage 7 rhceph/rhceph-haproxy-rhel9 Red Hat Ceph Storage 8 rhceph/rhceph-haproxy-rhel9 Red Hat Ceph Storage 9 rhceph-ci/haproxy, rhceph/rhceph-haproxy-rhel9, rhceph/rhceph-haproxy-rhel10
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux 7 haproxy
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 haproxy, haproxy18, haproxy20, haproxy22, haproxy26, haproxy28 Red Hat OpenShift Container Platform 5 openshift5/ose-hypershift-rhel9
    affected: workaround, no fix available
  • Red Hat Enterprise Linux AppStream (v. 9) haproxy 2.8.14-3.el9_8.2
    fixed: vendor fix RHSA-2026:55772
  • Red Hat Enterprise Linux AppStream (v. 10) haproxy 3.0.5-6.el10_2.2
    fixed: vendor fix RHSA-2026:55679
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) haproxy 2.4.17-6.el9_2.5
    fixed: vendor fix RHSA-2026:55802
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) haproxy 2.4.22-3.el9_4.3
    fixed: vendor fix RHSA-2026:55801
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) haproxy 3.0.5-4.el10_0.3
    fixed: vendor fix RHSA-2026:55800
show 6 more
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) haproxy 2.4.22-4.el9_6.3
    fixed: vendor fix RHSA-2026:55803
  • Red Hat Hardened Images haproxy 3.0.25-0.1.hum1
    fixed: vendor fix RHSA-2026:35453
  • Red Hat Update Infrastructure 5 rhui5/haproxy-rhel9 1788880456
    fixed: vendor fix RHSA-2026:66018
  • Red Hat Enterprise Linux 8 haproxy Red Hat OpenShift Container Platform 4 openshift4/ose-tests-rhel9, openshift4/ose-haproxy-router, openshift4/ose-hypershift-rhel9, openshift4/ose-haproxy-router-rhel9, openshift4/ose-vsphere-cluster-api-controllers-rhel8
    not affected: vulnerable code not present
  • Red Hat OpenShift Container Platform 5 haproxy, openshift5/ose-tests-rhel9, openshift5/ose-haproxy-router-rhel9
    not affected: vulnerable code not in execute path
  • Red Hat Update Infrastructure 5 rhui5/cds-rhel9 1788880464, rhui5/rhua-rhel9 1788880581, rhui5/installer-rhel9 1788765051, rhui5/cds-kubernetes-rhel9 1788880445
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 9.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
CNA 4.0 9.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami haproxy
<2.4.36
>=2.5.0, <2.6.30
>=2.7.0, <2.8.25
>=2.9.0, <3.0.24
>=3.1.0, <3.2.20
>=3.3.0, <3.4.1
2.4.36
2.6.30
2.8.25
3.0.24
3.2.20
3.4.1

Affected products

  • haproxy haproxy

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.