CVE-2026-55203
HAProxy - Integer Overflow in FCGI Demux Record Length Field
- State
- Published
- Severity
- 9.0 Critical
- Published
- Jun 18, 2026
- Updated
- Jul 14, 2026
- Reserved
- Jun 16, 2026
Description
HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.0 Critical | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N | VulnCheck |
Weaknesses
- CWE-190 Integer Overflow or Wraparound
Affected Products
| Product | Versions |
|---|---|
haproxyhaproxy |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.