CVE-2026-55203
Full vulnerability record from the local CVENow database.
Description
HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.
Severity
CRITICAL
CVSS score
9.0
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-06-18 17:16:34.373000
Last modified
2026-10-26 00:10:00.150000
View original CVE JSON
{
"id": "CVE-2026-55203",
"sourceIdentifier": "[email protected]",
"published": "2026-06-18T17:16:34.373",
"lastModified": "2026-10-26T00:10:00.150",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues."
},
{
"lang": "es",
"value": "HAProxy hasta la versión 3.4.0, corregido en el commit 5985276, contiene una vulnerabilidad de desbordamiento de entero en el campo drl de la estructura fcgi_conn que permite un análisis incorrecto del búfer como nuevas cabeceras de registro FCGI. Cuando contentLength es 65535 y paddingLength es 1 o más, el campo drl vuelve a 0, causando un consumo incorrecto de registros y permitiendo a backends FastCGI maliciosos desincronizar el analizador de tramas FCGI, lo que podría causar errores de enrutamiento de solicitudes, contrabando de respuestas o problemas de seguridad de la memoria."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "haproxy",
"product": "haproxy",
"defaultStatus": "unaffected",
"repo": "https://github.com/haproxy/haproxy",
"packageURL": "pkg:github/haproxy/haproxy",
"versions": [
{
"version": "0",
"lessThanOrEqual": "3.4.0",
"versionType": "semver",
"status": "affected"
},
{
"version": "5985276735777634d8c85f1d73bb7764aab0d6dd",
"versionType": "git",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.2,
"impactScore": 4.7
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-23T02:04:34.549032Z",
"id": "CVE-2026-55203",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-190"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.4.36",
"matchCriteriaId": "88E7AA4A-F1FA-4F49-A292-438B28F462C9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.5",
"versionEndExcluding": "2.6.30",
"matchCriteriaId": "2D8EB6E1-7127-4DD4-A00B-442795722F1A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.7",
"versionEndExcluding": "2.8.25",
"matchCriteriaId": "AEE6ECD6-2498-4961-A27F-9B12379C8CC6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.9",
"versionEndExcluding": "3.0.24",
"matchCriteriaId": "DE40B7E0-830C-4D4E-ACDF-97C503312707"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.1",
"versionEndExcluding": "3.2.20",
"matchCriteriaId": "60DCBD0D-4201-4AAD-A6D3-178F8412EB44"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.3",
"versionEndExcluding": "3.4.1",
"matchCriteriaId": "6D9D0A12-A3D0-4E8D-BB1C-F964910A004D"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/haproxy/haproxy/commit/5985276735777634d8c85f1d73bb7764aab0d6dd",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://www.vulncheck.com/advisories/haproxy-integer-overflow-in-fcgi-demux-record-length-field",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}