high CVSS 7.5 EPSS 0.58%

CVE-2026-55203·HAProxy vulnerability

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

Severity
high
Software
HAProxy
Fixed in
3.4.1
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.58% — higher than 46% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-55203 scores 7.5 on CVSS, so a successful attack would be serious — but at 0.58%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

From: 3.3

Until: 3.4.1

Fixed in: 3.4.1

How to fix this CVE

Upgrade HAProxy to version 3.4.1 or later to resolve an integer overflow vulnerability in the FCGI demultiplexer that can be exploited by malicious FastCGI backends. This vulnerability affects versions 3.3 through 3.4.0 and can lead to request desynchronization, response smuggling, or memory safety issues. Apply the update immediately if you are running HAProxy with FastCGI backend connections.

sudo dnf update haproxy -y && sudo systemctl restart haproxy

Defensia detects this vulnerability

How to check if you are affected

  1. Check the running version: haproxy -v | grep 'HA-Proxy version'
  2. Verify the installed package version: apt show haproxy | grep Version (Ubuntu/Debian) or rpm -qa haproxy (RHEL/CentOS)
  3. Determine if FastCGI backend connections are configured: grep -i 'fcgi' /etc/haproxy/haproxy.cfg
  4. Confirm the patch: haproxy -v and verify version is 3.4.1 or higher, and review git log for commit 5985276 if building from source

FAQ

What is CVE-2026-55203?

CVE-2026-55203 is an integer overflow vulnerability in HAProxy's FCGI record parser that occurs when contentLength and paddingLength values trigger an overflow in the drl (demux record length) field, causing the parser to misinterpret subsequent FCGI records. A malicious FastCGI backend can exploit this to desynchronize the protocol framing and potentially route requests incorrectly or smuggle responses.

Is CVE-2026-55203 being actively exploited?

No, CVE-2026-55203 is not currently listed on the CISA KEV catalog and no public exploits are available. However, it requires a compromised or malicious FastCGI backend, making it a privilege escalation or supply-chain risk in multi-tenant or untrusted backend environments.

What versions of HAProxy are affected by CVE-2026-55203?

HAProxy versions 3.3.0 through 3.4.0 (inclusive) are vulnerable. Version 3.4.1 and later contain the fix from commit 5985276.

How do I check if my server is vulnerable to CVE-2026-55203?

Run 'haproxy -v' and check the version number. If it shows 3.3.x or 3.4.0, your installation is vulnerable. Also confirm FastCGI is in use with 'grep -i fcgi /etc/haproxy/haproxy.cfg'.

Does Defensia detect CVE-2026-55203?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If HAProxy is installed on a monitored server, CVE-2026-55203 will appear in your dashboard with remediation steps.

Related HAProxy CVEs

CVE-2026-55204CVSS 7.5HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.
CVE-2026-110353CVSS 7.5HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.
CVE-2026-110354CVSS 7.5HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
CVE-2026-26081CVSS 4.8HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-55203. Free for 1 server.

Get started free