Red Hat Security Advisory

RHSA-2026:55802

haproxy security update

Released 2026-08-17 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v.9.2) haproxy-2.4.17-6.el9_2.5

Fixes 2 records

TI-2026-39884 CVE-2026-55204 · GHSA-4vj2-5mvx-3vcc

HAProxy - NULL Pointer Dereference in hpack_dht_insert Function

MEDIUM 44

HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00484 Published 2026-06-18 Partial fix CWE-476

TI-2026-39883 CVE-2026-55203 · GHSA-58mj-cmhg-35rg

HAProxy - Integer Overflow in FCGI Demux Record Length Field

LOW 39

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers.

CVSS 4.0CRITICAL 9.0 Network No auth No interaction EPSS 0.00334 Published 2026-06-18 Partial fix CWE-190