Read the docs
TI-2026-39883 Aliases CVE-2026-55203GHSA-58mj-cmhg-35rg

HAProxy - Integer Overflow in FCGI Demux Record Length Field

Priority LOW 39CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 8 fixed, 8 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00334 26th percentileScored 2026-11-07
Fix Partial Red Hat: 8 advisoriesRed Hat: 8 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HAProxyhaproxyup to 3.4.0—Patch availableCNA
  • haproxy VendorHAProxy Affected up to 3.4.0 Fixed in — Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*before 2.4.36; 2.5 to before 2.6.30; 2.7 to before 2.8.25; 2.9 to before 3.0.24; 3.1 to before 3.2.20; 3.3 to before 3.4.1VulnerableHAProxy
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* Versions before 2.4.36; 2.5 to before 2.6.30; 2.7 to before 2.8.25; 2.9 to before 3.0.24; 3.1 to before 3.2.20; 3.3 to before 3.4.1 Vulnerable ·HAProxy

Remediation

Red Hat 8 advisories

  • RHSA-2026:66018 Released 2026-09-09 · Red Hat rating Important
    Red Hat Update Infrastructure 5.3 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
  • RHSA-2026:55803 Released 2026-08-17 · Red Hat rating Important
    haproxy security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) haproxy-2.4.22-4.el9_6.3
  • RHSA-2026:55802 Released 2026-08-17 · Red Hat rating Important
    haproxy security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) haproxy-2.4.17-6.el9_2.5
Show 5 more Red Hat advisories
  • RHSA-2026:55801 Released 2026-08-17 · Red Hat rating Important
    haproxy security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) haproxy-2.4.22-3.el9_4.3
  • RHSA-2026:55800 Released 2026-08-17 · Red Hat rating Important
    haproxy security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) haproxy-3.0.5-4.el10_0.3
  • RHSA-2026:55772 Released 2026-08-17 · Red Hat rating Important
    haproxy security update
    • Red Hat Enterprise Linux AppStream (v. 9) haproxy-2.8.14-3.el9_8.2
  • RHSA-2026:55679 Released 2026-08-17 · Red Hat rating Important
    haproxy security update
    • Red Hat Enterprise Linux AppStream (v. 10) haproxy-3.0.5-6.el10_2.2
  • RHSA-2026:35453 Released 2026-07-03 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images haproxy-3.0.25-0.1.hum1@aarch64, haproxy-3.0.25-0.1.hum1@src, haproxy-3.0.25-0.1.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 5AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 6AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 7AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:55679
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:55772
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:55802
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:55801
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:55800
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:55803
Red Hat Hardened ImagesFixed RHSA-2026:35453
Red Hat Update Infrastructure 5Fixed RHSA-2026:66018
Not affected: 4 products
  • Red Hat Enterprise Linux 8
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat Update Infrastructure 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55203
  2. 2026-10-03 Alias added: GHSA-58mj-cmhg-35rg
  3. 2026-10-10 Priority changed: MEDIUM → LOW
  4. 2026-11-05 Affected versions changed · Red Hat

References

Patch 1

  • TI-2020-08973 In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before… CVSS 3.1HIGH 8.8
  • TI-2023-21094 HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23… CVSS 3.1HIGH 7.2
  • TI-2019-10602 HAProxy through 2.0.2 allows attackers to cause a denial of service (ha_panic) via… CVSS 3.0HIGH 7.5
  • TI-2021-17418 An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be… CVSS 3.1HIGH 7.5
  • TI-2016-04651 HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote… CVSS 3.0HIGH 7.5
  • TI-2026-25946 An issue was discovered in HAProxy before 3.3.6. CVSS 3.1MEDIUM 5.8
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences