PT-2026-32395 · Haproxy · Haproxy

Martino Spagnuolo · Published 2026-04-13 · Updated 2026-04-17 · CVE-2026-33555

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions HAProxy versions 2.6 through 3.3.5

Description The HTTP/3 parser fails to verify that the received body length aligns with a previously announced content-length when a stream is closed using a frame with an empty payload. This discrepancy can lead to desynchronization between the proxy and the backend server, potentially enabling request smuggling, which is a technique used to interfere with the way a website processes sequences of HTTP requests.

Recommendations Update to version 3.3.6 or later.

Fix

Weakness Enumeration

CWE-130

Related Identifiers

CVE-2026-33555

Affected Products

Haproxy

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-33555 · Security Note
• https://github.com/haproxy/haproxy/commit/05a295441c621089ffa4318daf0dbca2dd756a84 · Note
• https://reddit.com/r/AskNetsec/comments/1sngxwy/haproxy_http3_http1_desync_crossprotocol · Reddit Post
• https://twitter.com/_r_netsec/status/2044871724290945394 · Twitter Post
• https://twitter.com/r3verii/status/2044866028295909724 · Twitter Post
• https://haproxy.com/documentation/haproxy-aloha/changelog · Note
• https://twitter.com/securityshell/status/2045045773503500523 · Twitter Post
• https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html · Reddit Post
• https://twitter.com/secharvesterx/status/2044883676782047296 · Twitter Post
• https://haproxy.org · Note
• https://mail-archive.com/[e-mail]/msg46752.html · Note