CVE-2026-33555

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

CVSS v3 4.0 MEDIUM

4.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/haproxy/haproxy/commit/05a295441c621089ffa4318daf0dbca2dd756a84	Patch
https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html	Exploit Third Party Advisory
https://www.haproxy.com/documentation/haproxy-aloha/changelog/	Release Notes
https://www.haproxy.org	Product
https://www.mail-archive.com/haproxy@formilux.org/msg46752.html	Release Notes
https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-13 17:16

Updated : 2026-06-29 15:28

NVD link : CVE-2026-33555

Mitre link : CVE-2026-33555

CVE.ORG link : CVE-2026-33555

JSON object : View

Products Affected

haproxy

haproxy

CWE

CWE-130

Improper Handling of Length Parameter Inconsistency

{"id": "CVE-2026-33555", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33555", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T18:42:59.239377Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "HAProxy", "product": "HAProxy", "versions": [{"status": "affected", "version": "2.6", "lessThan": "3.3.6", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-13T17:16:28.237", "references": [{"url": "https://github.com/haproxy/haproxy/commit/05a295441c621089ffa4318daf0dbca2dd756a84", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.haproxy.com/documentation/haproxy-aloha/changelog/", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://www.haproxy.org", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://www.mail-archive.com/haproxy@formilux.org/msg46752.html", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-130"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6."}], "lastModified": "2026-06-29T15:28:15.663", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0C66EEE-8E91-4525-9187-0FB58152B8BC", "versionEndExcluding": "3.3.6", "versionStartIncluding": "2.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}