PT-2026-50707 · Haproxy+2 · Haproxy+2
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
HAProxy versions prior to 3.4.0
Description
An integer overflow exists in the
drl field of the fcgi conn structure within the FastCGI parser. When the contentLength is 65535 and the paddingLength is 1 or more, the drl field wraps to 0. This causes the system to misparse FastCGI record headers and desynchronize the framing state machine. A malicious or spoofed FastCGI backend can exploit this to corrupt request and response boundaries, leading to request routing errors, response smuggling across clients, or memory safety issues.Recommendations
Apply commit 5985276 to resolve the issue in versions prior to 3.4.0.
Exploit
Fix
DoS
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Haproxy
Linuxmint
Ubuntu