CVE catalog

CVE-2026-55203

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLe

[CVE catalog]

Severity
Critical · CVSS 9CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Source
[NVD] · [CVE record]
EPSS
0.33% · Oct 25, 2026

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianhaproxysid3.2.26-1fixed
Debianhaproxyforky3.2.26-1fixed
Debianhaproxytrixie3.0.11-1+deb13u3vulnerable
Debianhaproxytrixie-security3.0.11-1+deb13u4vulnerable
Debianhaproxybookworm2.6.12-1+deb12u3vulnerable
Debianhaproxybookworm-security2.6.12-1+deb12u4vulnerable
CpehaproxyNot reported2.8.16-0ubuntu0.24.04.3fixed
Cpehaproxy-docNot reported2.8.16-0ubuntu0.24.04.3fixed
Cpevim-haproxyNot reported2.8.16-0ubuntu0.24.04.3fixed
CpehaproxyNot reportedNot reportedvulnerable
CpehaproxyNot reportedNot reportedunknown
CpehaproxyNot reported3.4.1fixed
Susehaproxylinux micro 6.12.8.11+git0.01c1056a4-slfo.1.1_4.1fixed
Susehaproxylinux enterprise server for sap applications 16.03.2.21+git0.dbe43be37-160000.1.1fixed
Susehaproxylinux enterprise high availability extension 16.03.2.21+git0.dbe43be37-160000.1.1fixed
Susehaproxylinux micro 6.23.2.21+git0.dbe43be37-160000.1.1fixed
Susehaproxylinux micro 6.02.8.11+git0.01c1056a4-4.1fixed
Opensusehaproxyleap 16.03.2.21+git0.dbe43be37-160000.1.1fixed
Ubuntuhaproxypro1.7.9-1ubuntu1vulnerable
Ubuntuhaproxypro1.7.9-1ubuntu2vulnerable
Ubuntuhaproxypro1.8.4-1vulnerable
Ubuntuhaproxypro1.8.7-1vulnerable
Ubuntuhaproxypro1.8.8-1vulnerable
Ubuntuhaproxypro1.8.8-1ubuntu0.1vulnerable
Ubuntuhaproxypro1.8.8-1ubuntu0.2vulnerable
Ubuntuhaproxypro1.8.8-1ubuntu0.3vulnerable
Ubuntuhaproxypro1.8.8-1ubuntu0.4vulnerable
Ubuntuhaproxypro1.8.8-1ubuntu0.6vulnerable
Ubuntuhaproxypro1.8.8-1ubuntu0.7vulnerable
Ubuntuhaproxypro1.8.8-1ubuntu0.8vulnerable
Ubuntuhaproxypro1.8.8-1ubuntu0.9vulnerable
Ubuntuhaproxypro1.8.8-1ubuntu0.10vulnerable
Ubuntuhaproxypro1.8.8-1ubuntu0.11vulnerable
Ubuntuhaproxypro1.8.8-1ubuntu0.13vulnerable
Ubuntuhaproxypro1.8.8-1ubuntu0.13+esm2vulnerable
Ubuntuhaproxypro1.8.8-1ubuntu0.13+esm3vulnerable
Ubuntuhaproxy20.042.0.5-1vulnerable
Ubuntuhaproxy20.042.0.8-1vulnerable
Ubuntuhaproxy20.042.0.9-1vulnerable
Ubuntuhaproxy20.042.0.10-1vulnerable
Ubuntuhaproxy20.042.0.10-1ubuntu1vulnerable
Ubuntuhaproxy20.042.0.11-1ubuntu1vulnerable
Ubuntuhaproxy20.042.0.12-1ubuntu2vulnerable
Ubuntuhaproxy20.042.0.13-1ubuntu2vulnerable
Ubuntuhaproxy20.042.0.13-2vulnerable
Ubuntuhaproxy20.042.0.13-2ubuntu0.1vulnerable
Ubuntuhaproxy20.042.0.13-2ubuntu0.2vulnerable
Ubuntuhaproxy20.042.0.13-2ubuntu0.3vulnerable
Ubuntuhaproxy20.042.0.13-2ubuntu0.5vulnerable
Ubuntuhaproxy20.042.0.29-0ubuntu1vulnerable
Ubuntuhaproxy20.042.0.29-0ubuntu1.1vulnerable
Ubuntuhaproxy20.042.0.29-0ubuntu1.3vulnerable
Ubuntuhaproxy20.042.0.31-0ubuntu0.1vulnerable
Ubuntuhaproxy20.042.0.31-0ubuntu0.2vulnerable
Ubuntuhaproxy20.042.0.31-0ubuntu0.3vulnerable
Ubuntuhaproxy20.042.0.33-0ubuntu0.1vulnerable
Ubuntuhaproxy22.042.2.9-2ubuntu2vulnerable
Ubuntuhaproxy22.042.4.8-1vulnerable
Ubuntuhaproxy22.042.4.8-2ubuntu3vulnerable
Ubuntuhaproxy22.042.4.11-1ubuntu1vulnerable
Ubuntuhaproxy22.042.4.12-1ubuntu1vulnerable
Ubuntuhaproxy22.042.4.12-1ubuntu2vulnerable
Ubuntuhaproxy22.042.4.13-1ubuntu1vulnerable
Ubuntuhaproxy22.042.4.14-1ubuntu1vulnerable
Ubuntuhaproxy22.042.4.18-0ubuntu1vulnerable
Ubuntuhaproxy22.042.4.18-0ubuntu1.1vulnerable
Ubuntuhaproxy22.042.4.18-0ubuntu1.2vulnerable
Ubuntuhaproxy22.042.4.18-0ubuntu1.3vulnerable
Ubuntuhaproxy22.042.4.22-0ubuntu0.22.04.1vulnerable
Ubuntuhaproxy22.042.4.22-0ubuntu0.22.04.2vulnerable
Ubuntuhaproxy22.042.4.22-0ubuntu0.22.04.3vulnerable
Ubuntuhaproxy22.042.4.24-0ubuntu0.22.04.1vulnerable
Ubuntuhaproxy22.042.4.24-0ubuntu0.22.04.2vulnerable
Ubuntuhaproxy22.042.4.24-0ubuntu0.22.04.3vulnerable
Ubuntuhaproxy22.042.4.29-0ubuntu0.22.04.1vulnerable
Ubuntuhaproxy22.042.4.30-0ubuntu0.22.04.1vulnerable
Ubuntuhaproxy22.042.4.30-0ubuntu0.22.04.2fixed
Ubuntuhaproxy24.042.6.15-1ubuntu2vulnerable
Ubuntuhaproxy24.042.8.5-1ubuntu1vulnerable
Ubuntuhaproxy24.042.8.5-1ubuntu2vulnerable
Ubuntuhaproxy24.042.8.5-1ubuntu3vulnerable
Ubuntuhaproxy24.042.8.5-1ubuntu3.1vulnerable
Ubuntuhaproxy24.042.8.5-1ubuntu3.2vulnerable
Ubuntuhaproxy24.042.8.5-1ubuntu3.3vulnerable
Ubuntuhaproxy24.042.8.5-1ubuntu3.4vulnerable
Ubuntuhaproxy24.042.8.15-0ubuntu0.24.04.1vulnerable
Ubuntuhaproxy24.042.8.16-0ubuntu0.24.04.1vulnerable
Ubuntuhaproxy24.042.8.16-0ubuntu0.24.04.2vulnerable
Ubuntuhaproxy24.042.8.16-0ubuntu0.24.04.3fixed
Ubuntuhaproxy25.103.0.8-1ubuntu1vulnerable
Ubuntuhaproxy25.103.0.8-1ubuntu1.1vulnerable
Ubuntuhaproxy25.103.0.10-1ubuntu1vulnerable
Ubuntuhaproxy25.103.0.10-1ubuntu2vulnerable
Ubuntuhaproxy25.103.0.10-1ubuntu3vulnerable
Ubuntuhaproxy25.103.0.12-0ubuntu0.25.10.1vulnerable
Ubuntuhaproxy25.103.0.12-0ubuntu0.25.10.3vulnerable
Ubuntuhaproxy25.103.0.12-0ubuntu0.25.10.4vulnerable
Ubuntuhaproxy25.103.0.12-0ubuntu0.25.10.5fixed
Ubuntuhaproxy26.043.0.10-1ubuntu3vulnerable
Ubuntuhaproxy26.043.2.9-1ubuntu1vulnerable
Ubuntuhaproxy26.043.2.9-1ubuntu2vulnerable
Ubuntuhaproxy26.043.2.9-1ubuntu2.1vulnerable
Ubuntuhaproxy26.043.2.9-1ubuntu2.2fixed
Ubuntuhaproxy22.042.2.9-2ubuntu2vulnerable
Ubuntuhaproxy22.042.4.8-1vulnerable
Ubuntuhaproxy22.042.4.8-2ubuntu3vulnerable
Ubuntuhaproxy22.042.4.11-1ubuntu1vulnerable
Ubuntuhaproxy22.042.4.12-1ubuntu1vulnerable
Ubuntuhaproxy22.042.4.12-1ubuntu2vulnerable
Ubuntuhaproxy22.042.4.13-1ubuntu1vulnerable
Ubuntuhaproxy22.042.4.14-1ubuntu1vulnerable
Ubuntuhaproxy22.042.4.18-0ubuntu1vulnerable
Ubuntuhaproxy22.042.4.18-0ubuntu1.1vulnerable
Ubuntuhaproxy22.042.4.18-0ubuntu1.2vulnerable
Ubuntuhaproxy22.042.4.18-0ubuntu1.3vulnerable
Ubuntuhaproxy22.042.4.22-0ubuntu0.22.04.1vulnerable
Ubuntuhaproxy22.042.4.22-0ubuntu0.22.04.2vulnerable
Ubuntuhaproxy22.042.4.22-0ubuntu0.22.04.3vulnerable
Ubuntuhaproxy22.042.4.24-0ubuntu0.22.04.1vulnerable
Ubuntuhaproxy22.042.4.24-0ubuntu0.22.04.2vulnerable
Ubuntuhaproxy22.042.4.24-0ubuntu0.22.04.3vulnerable
Ubuntuhaproxy22.042.4.29-0ubuntu0.22.04.1vulnerable
Ubuntuhaproxy22.042.4.30-0ubuntu0.22.04.1vulnerable
Ubuntuhaproxy22.042.4.30-0ubuntu0.22.04.2fixed
Ubuntuhaproxy24.042.6.15-1ubuntu2vulnerable
Ubuntuhaproxy24.042.8.5-1ubuntu1vulnerable
Ubuntuhaproxy24.042.8.5-1ubuntu2vulnerable
Ubuntuhaproxy24.042.8.5-1ubuntu3vulnerable
Ubuntuhaproxy24.042.8.5-1ubuntu3.1vulnerable
Ubuntuhaproxy24.042.8.5-1ubuntu3.2vulnerable
Ubuntuhaproxy24.042.8.5-1ubuntu3.3vulnerable
Ubuntuhaproxy24.042.8.5-1ubuntu3.4vulnerable
Ubuntuhaproxy24.042.8.15-0ubuntu0.24.04.1vulnerable
Ubuntuhaproxy24.042.8.16-0ubuntu0.24.04.1vulnerable
Ubuntuhaproxy24.042.8.16-0ubuntu0.24.04.2vulnerable
Ubuntuhaproxy24.042.8.16-0ubuntu0.24.04.3fixed
Ubuntuhaproxy25.103.0.8-1ubuntu1vulnerable
Ubuntuhaproxy25.103.0.8-1ubuntu1.1vulnerable
Ubuntuhaproxy25.103.0.10-1ubuntu1vulnerable
Ubuntuhaproxy25.103.0.10-1ubuntu2vulnerable
Ubuntuhaproxy25.103.0.10-1ubuntu3vulnerable
Ubuntuhaproxy25.103.0.12-0ubuntu0.25.10.1vulnerable
Ubuntuhaproxy25.103.0.12-0ubuntu0.25.10.3vulnerable
Ubuntuhaproxy25.103.0.12-0ubuntu0.25.10.4vulnerable
Ubuntuhaproxy25.103.0.12-0ubuntu0.25.10.5fixed
Ubuntuhaproxy26.043.0.10-1ubuntu3vulnerable
Ubuntuhaproxy26.043.2.9-1ubuntu1vulnerable
Ubuntuhaproxy26.043.2.9-1ubuntu2vulnerable
Ubuntuhaproxy26.043.2.9-1ubuntu2.1vulnerable
Ubuntuhaproxy26.043.2.9-1ubuntu2.2fixed
Susehaproxylinux enterprise micro 5.32.4.22+git0.f8e3218e2-150400.3.28.1fixed
Susehaproxylinux enterprise micro 5.42.4.22+git0.f8e3218e2-150400.3.28.1fixed
Susehaproxylinux enterprise micro 5.52.4.22+git0.f8e3218e2-150400.3.28.1fixed
Susehaproxylinux enterprise high availability extension 15 sp42.4.22+git0.f8e3218e2-150400.3.28.1fixed
Susehaproxylinux enterprise high availability extension 15 sp52.4.22+git0.f8e3218e2-150400.3.28.1fixed
Susehaproxylinux enterprise high availability extension 15 sp62.8.11+git0.01c1056a4-150600.3.15.1fixed
Susehaproxylinux enterprise high availability extension 15 sp72.8.11+git0.01c1056a4-150600.3.15.1fixed
Opensusehaproxytumbleweed3.4.0+git31.fc300e9f2-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianhaproxysourcesid3.2.20-1not yet assignedNot reported[1140430]
Debianhaproxysourceforky3.2.20-1not yet assignedNot reported[1140430]
Debianhaproxysourcetrixie(unfixed)not yet assignedNot reported[1140430]
Debianhaproxysourcebookworm(unfixed)not yet assignedNot reported[1140430]
CpehaproxycpeNot reported2.8.16-0ubuntu0.24.04.3Not reportedNot reportedNot reported
Cpehaproxy-doccpeNot reported2.8.16-0ubuntu0.24.04.3Not reportedNot reportedNot reported
Cpevim-haproxycpeNot reported2.8.16-0ubuntu0.24.04.3Not reportedNot reportedNot reported
CpehaproxycpeNot reported3.4.1Not reportedNVD-CVE-2026-55203Not reported
Susehaproxyrpmlinux micro 6.12.8.11+git0.01c1056a4-slfo.1.1_4.1Not reportedSUSE-SU-2026:22663-1Not reported
Susehaproxyrpmlinux enterprise server for sap applications 16.03.2.21+git0.dbe43be37-160000.1.1Not reportedSUSE-SU-2026:22587-1Not reported
Susehaproxyrpmlinux enterprise high availability extension 16.03.2.21+git0.dbe43be37-160000.1.1Not reportedSUSE-SU-2026:22557-1Not reported
Susehaproxyrpmlinux micro 6.23.2.21+git0.dbe43be37-160000.1.1Not reportedSUSE-SU-2026:22544-1Not reported
Susehaproxyrpmlinux micro 6.02.8.11+git0.01c1056a4-4.1Not reportedSUSE-SU-2026:22515-1Not reported
Opensusehaproxyrpmleap 16.03.2.21+git0.dbe43be37-160000.1.1Not reportedOPENSUSE-SU-2026:21245-1Not reported
Ubuntuhaproxydeb22.042.4.30-0ubuntu0.22.04.2Not reportedUBUNTU-CVE-2026-55203Not reported
Ubuntuhaproxydeb24.042.8.16-0ubuntu0.24.04.3Not reportedUBUNTU-CVE-2026-55203Not reported
Ubuntuhaproxydeb25.103.0.12-0ubuntu0.25.10.5Not reportedUBUNTU-CVE-2026-55203Not reported
Ubuntuhaproxydeb26.043.2.9-1ubuntu2.2Not reportedUBUNTU-CVE-2026-55203Not reported
Ubuntuhaproxydeb22.042.4.30-0ubuntu0.22.04.2Not reportedUSN-8459-1Not reported
Ubuntuhaproxydeb24.042.8.16-0ubuntu0.24.04.3Not reportedUSN-8459-1Not reported
Ubuntuhaproxydeb25.103.0.12-0ubuntu0.25.10.5Not reportedUSN-8459-1Not reported
Ubuntuhaproxydeb26.043.2.9-1ubuntu2.2Not reportedUSN-8459-1Not reported
Susehaproxyrpmlinux enterprise micro 5.32.4.22+git0.f8e3218e2-150400.3.28.1Not reportedSUSE-SU-2026:2651-1Not reported
Susehaproxyrpmlinux enterprise micro 5.42.4.22+git0.f8e3218e2-150400.3.28.1Not reportedSUSE-SU-2026:2651-1Not reported
Susehaproxyrpmlinux enterprise micro 5.52.4.22+git0.f8e3218e2-150400.3.28.1Not reportedSUSE-SU-2026:2651-1Not reported
Susehaproxyrpmlinux enterprise high availability extension 15 sp42.4.22+git0.f8e3218e2-150400.3.28.1Not reportedSUSE-SU-2026:2651-1Not reported
Susehaproxyrpmlinux enterprise high availability extension 15 sp52.4.22+git0.f8e3218e2-150400.3.28.1Not reportedSUSE-SU-2026:2651-1Not reported
Susehaproxyrpmlinux enterprise high availability extension 15 sp62.8.11+git0.01c1056a4-150600.3.15.1Not reportedSUSE-SU-2026:2652-1Not reported
Susehaproxyrpmlinux enterprise high availability extension 15 sp72.8.11+git0.01c1056a4-150600.3.15.1Not reportedSUSE-SU-2026:2652-1Not reported
Opensusehaproxyrpmtumbleweed3.4.0+git31.fc300e9f2-1.1Not reportedOPENSUSE-SU-2026:11090-1Not reported

[Debian bug #1140430]

Notes

[trixie] haproxy: Minor issue [bookworm] haproxy: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [haproxy]Affected
    Details (4)
    • 2.6.12-1+deb12u3 · amd64 · bookworm

      Affected

      nvd · haproxy · debian · bookworm; nvd · haproxy · debian · 12

    • 2.6.12-1+deb12u3 · arm64 · bookworm

      Affected

      nvd · haproxy · debian · bookworm; nvd · haproxy · debian · 12

    • 2.6.12-1+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · haproxy · debian · bookworm; nvd · haproxy · debian · 12

    • 2.6.12-1+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · haproxy · debian · bookworm; nvd · haproxy · debian · 12

  • [haproxy-doc]Affected

    Source package: [haproxy]

    Details (4)
    • 2.6.12-1+deb12u3 · all · bookworm

      Affected

      nvd · haproxy · debian · bookworm; nvd · haproxy · debian · 12

    • 2.6.12-1+deb12u3 · all · bookworm

      Affected

      nvd · haproxy · debian · bookworm; nvd · haproxy · debian · 12

    • 2.6.12-1+deb12u3 · all · bookworm-security

      Affected

      nvd · haproxy · debian · bookworm; nvd · haproxy · debian · 12

    • 2.6.12-1+deb12u3 · all · bookworm-security

      Affected

      nvd · haproxy · debian · bookworm; nvd · haproxy · debian · 12

  • [vim-haproxy]Affected

    Source package: [haproxy]

    Details (4)
    • 2.6.12-1+deb12u3 · all · bookworm

      Affected

      nvd · haproxy · debian · bookworm; nvd · haproxy · debian · 12

    • 2.6.12-1+deb12u3 · all · bookworm

      Affected

      nvd · haproxy · debian · bookworm; nvd · haproxy · debian · 12

    • 2.6.12-1+deb12u3 · all · bookworm-security

      Affected

      nvd · haproxy · debian · bookworm; nvd · haproxy · debian · 12

    • 2.6.12-1+deb12u3 · all · bookworm-security

      Affected

      nvd · haproxy · debian · bookworm; nvd · haproxy · debian · 12

[Debian 13 (Trixie)]

  • [haproxy]Affected
    Details (5)
    • 3.0.11-1+deb13u3 · amd64 · trixie

      Affected

      nvd · haproxy · debian · 13

    • 3.0.11-1+deb13u3 · arm64 · trixie

      Affected

      nvd · haproxy · debian · 13

    • 3.0.11-1+deb13u3 · amd64 · trixie-security · Historical version

      Affected

      nvd · haproxy · debian · 13

    • 3.0.11-1+deb13u3 · arm64 · trixie-security

      Affected

      nvd · haproxy · debian · 13

    • 3.0.11-1+deb13u4 · amd64 · trixie-security

      Affected

      nvd · haproxy · debian · 13

  • [haproxy-doc]Affected

    Source package: [haproxy]

    Details (5)
    • 3.0.11-1+deb13u3 · all · trixie

      Affected

      nvd · haproxy · debian · 13

    • 3.0.11-1+deb13u3 · all · trixie

      Affected

      nvd · haproxy · debian · 13

    • 3.0.11-1+deb13u3 · all · trixie-security

      Affected

      nvd · haproxy · debian · 13

    • 3.0.11-1+deb13u3 · all · trixie-security · Historical version

      Affected

      nvd · haproxy · debian · 13

    • 3.0.11-1+deb13u4 · all · trixie-security

      Affected

      nvd · haproxy · debian · 13

  • [vim-haproxy]Affected

    Source package: [haproxy]

    Details (5)
    • 3.0.11-1+deb13u3 · all · trixie

      Affected

      nvd · haproxy · debian · 13

    • 3.0.11-1+deb13u3 · all · trixie

      Affected

      nvd · haproxy · debian · 13

    • 3.0.11-1+deb13u3 · all · trixie-security

      Affected

      nvd · haproxy · debian · 13

    • 3.0.11-1+deb13u3 · all · trixie-security · Historical version

      Affected

      nvd · haproxy · debian · 13

    • 3.0.11-1+deb13u4 · all · trixie-security

      Affected

      nvd · haproxy · debian · 13

[openSUSE Tumbleweed]

  • [haproxy]Fixed

    Source package: [haproxy]

    Details (1)
    • 3.4.4+git0.7f03ae65c-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 3.4.0+git31.fc300e9f2-1.1

      nvd · haproxy · opensuse · tumbleweed

Observed:

References