PT-2026-50707 · Haproxy · Haproxy

Tristan Madani · Published 2026-06-18 · Updated 2026-06-18 · CVE-2026-55203

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2026-55203

Affected Products

Haproxy

References · 3

• https://github.com/haproxy/haproxy/commit/5985276735777634d8c85f1d73bb7764aab0d6dd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-55203 · Security Note
• https://vulncheck.com/advisories/haproxy-integer-overflow-in-fcgi-demux-record-length-field · Note