CVE-2026-33555 Other in HAProxy
An attacker can exploit HTTP/3 parser flaws in HAProxy to cause request smuggling and desynchronize backend servers, potentially bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33555?
CVE-2026-33555 is a medium-severity vulnerability in HAProxy, published on 13 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.
Weakness: CWE-130
Which versions are affected by CVE-2026-33555?
1 open source package ship an affected version, including haproxy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
haproxy Bitnami | From 2.6.0 | 3.3.6 |
Linux distribution packages (6)
haproxy Red Hat:hummingbird:1 | All versions | 0:3.0.19-1.1.hum1 |
haproxy SUSE:Linux Enterprise High Availability Extension 15 SP6 | All versions | 2.8.11+git0.01c1056a4-150600.3.12.1 |
haproxy SUSE:Linux Enterprise High Availability Extension 15 SP7 | All versions | 2.8.11+git0.01c1056a4-150600.3.12.1 |
haproxy SUSE:Linux Micro 6.2 | All versions | 3.2.15+git64.0fc44b458-160000.2.1 |
haproxy openSUSE:Leap 16.0 | All versions | 3.2.15+git64.0fc44b458-160000.2.1 |
haproxy openSUSE:Tumbleweed | All versions | 3.3.6+git91.af5637e93-1.1 |
Products include Haproxy Haproxy.
How do I fix CVE-2026-33555?
Upgrade haproxy to 3.3.6 or later.
Is CVE-2026-33555 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33555 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in HAProxy
Sources
Also known as AZL-82730, BIT-haproxy-2026-33555, DEBIAN-CVE-2026-33555, GHSA-5mp8-rq5m-pj7m, MGASA-2026-0146, MINI-frr2-6qcm-2x7q and 15 more.