CVE-2026-55203 HAProxy - Integer Overflow in FCGI Demux Record Length Field
A malicious FastCGI backend can trigger an integer overflow in HAProxy, leading to parser desynchronization, potential request smuggling, or memory safety issues.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55203?
CVE-2026-55203 is a critical vulnerability in haproxy, published on 18 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.
Weakness: CWE-190
Which versions are affected by CVE-2026-55203?
1 open source package ship an affected version, including haproxy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
haproxy Bitnami | All versions | 2.4.36, 2.6.30, 2.8.25, 3.0.24, 3.2.20, 3.4.1 |
Products include Haproxy Haproxy.
How do I fix CVE-2026-55203?
Upgrade haproxy to a fixed version for your release line: 2.4.36, 2.6.30, 2.8.25 or 3.0.24.
Is CVE-2026-55203 being exploited?
There is no known exploitation of CVE-2026-55203 in the wild and no public exploit code.
Other vulnerabilities in haproxy
Sources
Also known as AZL-90264, BIT-haproxy-2026-55203, CLSA-2026-1782725469, CLSA-2026-1782744931, DEBIAN-CVE-2026-55203, GHSA-58mj-cmhg-35rg and 9 more.