CVE-2026-55203

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/haproxy/haproxy/commit/5985276735777634d8c85f1d73bb7764aab0d6dd	Patch
https://www.vulncheck.com/advisories/haproxy-integer-overflow-in-fcgi-demux-record-length-field	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:haproxy:haproxy::::::::
	cpe:2.3:a:haproxy:haproxy::::::::
	cpe:2.3:a:haproxy:haproxy::::::::
	cpe:2.3:a:haproxy:haproxy::::::::
	cpe:2.3:a:haproxy:haproxy::::::::
	cpe:2.3:a:haproxy:haproxy::::::::

History

26 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) HAProxy hasta la versión 3.4.0, corregido en el commit 5985276, contiene una vulnerabilidad de desbordamiento de entero en el campo drl de la estructura fcgi_conn que permite un análisis incorrecto del búfer como nuevas cabeceras de registro FCGI. Cuando contentLength es 65535 y paddingLength es 1 o más, el campo drl vuelve a 0, causando un consumo incorrecto de registros y permitiendo a backends FastCGI maliciosos desincronizar el analizador de tramas FCGI, lo que podría causar errores de enrutamiento de solicitudes, contrabando de respuestas o problemas de seguridad de la memoria.

Information

Published : 2026-06-18 17:16

Updated : 2026-10-26 00:10

NVD link : CVE-2026-55203

Mitre link : CVE-2026-55203

CVE.ORG link : CVE-2026-55203

JSON object : View

Products Affected

haproxy

haproxy

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-55203", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55203", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T02:04:34.549032Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/haproxy/haproxy", "vendor": "haproxy", "product": "haproxy", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.4.0"}, {"status": "unaffected", "version": "5985276735777634d8c85f1d73bb7764aab0d6dd", "versionType": "git"}], "packageURL": "pkg:github/haproxy/haproxy", "defaultStatus": "unaffected"}]}], "published": "2026-06-18T17:16:34.373", "references": [{"url": "https://github.com/haproxy/haproxy/commit/5985276735777634d8c85f1d73bb7764aab0d6dd", "tags": ["Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/haproxy-integer-overflow-in-fcgi-demux-record-length-field", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues."}, {"lang": "es", "value": "HAProxy hasta la versi\u00f3n 3.4.0, corregido en el commit 5985276, contiene una vulnerabilidad de desbordamiento de entero en el campo drl de la estructura fcgi_conn que permite un an\u00e1lisis incorrecto del b\u00fafer como nuevas cabeceras de registro FCGI. Cuando contentLength es 65535 y paddingLength es 1 o m\u00e1s, el campo drl vuelve a 0, causando un consumo incorrecto de registros y permitiendo a backends FastCGI maliciosos desincronizar el analizador de tramas FCGI, lo que podr\u00eda causar errores de enrutamiento de solicitudes, contrabando de respuestas o problemas de seguridad de la memoria."}], "lastModified": "2026-10-26T00:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "88E7AA4A-F1FA-4F49-A292-438B28F462C9", "versionEndExcluding": "2.4.36"}, {"criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2D8EB6E1-7127-4DD4-A00B-442795722F1A", "versionEndExcluding": "2.6.30", "versionStartIncluding": "2.5"}, {"criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AEE6ECD6-2498-4961-A27F-9B12379C8CC6", "versionEndExcluding": "2.8.25", "versionStartIncluding": "2.7"}, {"criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE40B7E0-830C-4D4E-ACDF-97C503312707", "versionEndExcluding": "3.0.24", "versionStartIncluding": "2.9"}, {"criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "60DCBD0D-4201-4AAD-A6D3-178F8412EB44", "versionEndExcluding": "3.2.20", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6D9D0A12-A3D0-4E8D-BB1C-F964910A004D", "versionEndExcluding": "3.4.1", "versionStartIncluding": "3.3"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}