Log in Start free

Vulnerability · Published Jun 18, 2026 · Assigned by VulnCheck

CVE-2026-55203HAProxy - Integer Overflow in FCGI Demux Record Length Field

High 7.5

In plain English

A high-severity integer overflow in haproxy from haproxy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 73.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10haproxy3.0.5-6.el10_2.2ALSA-2026:55679
AlmaLinux:9haproxy2.8.14-3.el9_8.2ALSA-2026:55772
Debian:12haproxyno fix listedDEBIAN-CVE-2026-55203
Debian:13haproxyno fix listedDEBIAN-CVE-2026-55203
Debian:14haproxy3.2.20-1DEBIAN-CVE-2026-55203
Rocky Linux:10haproxy0:3.0.5-6.el10_2.2RLSA-2026:55679
Rocky Linux:9haproxy0:2.8.14-3.el9_8.2RLSA-2026:55772
Ubuntu:22.04:LTShaproxy2.4.30-0ubuntu0.22.04.2UBUNTU-CVE-2026-55203
Ubuntu:24.04:LTShaproxy2.8.16-0ubuntu0.24.04.3UBUNTU-CVE-2026-55203
Ubuntu:25.10haproxy3.0.12-0ubuntu0.25.10.5UBUNTU-CVE-2026-55203
Ubuntu:26.04:LTShaproxy3.2.9-1ubuntu2.2UBUNTU-CVE-2026-55203

Affected products (as reported)

VendorProductVersions
haproxy haproxy 0 – through 3.4.0

Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

References