Every CVE Search/ Get API key

CVE-2026-33555

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the...

4.0 MediumPublic exploitFix available

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.31%Up 0.3 points since Apr 14, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.0

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

Record
CVE-2026-33555
CVSS 3.1
4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Weakness
CWE-130
Updated
2026-11-02
EUVDEUVD-2026-21997 4.0

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

Record
EUVD-2026-21997
CVSS 3.1
4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-5mp8-rq5m-pj7m 4.0

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the...

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

Record
GHSA-5mp8-rq5m-pj7m
CVSS 3.1
4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Weakness
CWE-130
Updated
2026-11-02
NVD 4.0

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

Record
CVE-2026-33555
CVSS 3.1
4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Weakness
CWE-130
Updated
2026-11-02
OSV 4.0

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

Record
CVE-2026-33555
CVSS 3.1
4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Weakness
CWE-130
Updated
2026-11-04
OSVDEBIAN-CVE-2026-33555 5.8

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

Record
DEBIAN-CVE-2026-33555
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Updated
2026-11-02
Show 18 moreShow less
OSVOESA-2026-2083 4.0

haproxy security update

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.(CVE-2026-33555)

Record
OESA-2026-2083
CVSS 3.1
4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Updated
2026-11-02
OSVOESA-2026-2084 4.0

haproxy security update

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.(CVE-2026-33555)

Record
OESA-2026-2084
CVSS 3.1
4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Updated
2026-11-02
OSVOESA-2026-2085 4.0

haproxy security update

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.(CVE-2026-33555)

Record
OESA-2026-2085
CVSS 3.1
4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Updated
2026-11-02
OSVOESA-2026-2086 4.0

haproxy security update

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.(CVE-2026-33555)

Record
OESA-2026-2086
CVSS 3.1
4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:8749 4.0

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:8749
CVSS 3.1
4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-33555 4.0

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

Record
UBUNTU-CVE-2026-33555
CVSS 3.1
4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Updated
2026-11-02
OSVAZL-82730 No score

CVE-2026-33555 affecting package haproxy for versions less than 2.9.11-5

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

Record
AZL-82730
Updated
2026-11-05
OSVBIT-haproxy-2026-33555 No score

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

Record
BIT-haproxy-2026-33555
Updated
2026-11-02
OSVMGASA-2026-0146 No score

Updated haproxy packages fix security vulnerability

The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. (CVE-2026-33555)

Record
MGASA-2026-0146
Updated
2026-11-02
OSVopenSUSE-SU-2026:10581-1 No score

haproxy-3.3.6+git91.af5637e93-1.1 on GA media

These are all security issues fixed in the haproxy-3.3.6+git91.af5637e93-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10581-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20618-1 No score

Security update for haproxy

This update for haproxy fixes the following issues:

Security issue:

  • CVE-2026-33555: Request smuggling via HTTP/3 parser desynchronization (bsc#1262103).
  • bug in SLZ compression (bsc#1261626).
Record
openSUSE-SU-2026:20618-1
Updated
2026-11-02
OSVSUSE-SU-2026:1568-1 No score

Security update for haproxy

This update for haproxy fixes the following issue:

  • CVE-2026-33555: Request smuggling via HTTP/3 parser desynchronization (bsc#1262103).
Record
SUSE-SU-2026:1568-1
Updated
2026-11-02
OSVSUSE-SU-2026:21280-1 No score

Security update for haproxy

This update for haproxy fixes the following issues:

Security issue:

  • CVE-2026-33555: Request smuggling via HTTP/3 parser desynchronization (bsc#1262103).
  • bug in SLZ compression (bsc#1261626).
Record
SUSE-SU-2026:21280-1
Updated
2026-11-02
OSVSUSE-SU-2026:21289-1 No score

Security update for haproxy

This update for haproxy fixes the following issue:

  • CVE-2026-33555: improper validation when matching a received body length to a previously announced Content-Length can lead to request smuggling due to HTTP/3 parser desynchronization (bsc#1262103).
Record
SUSE-SU-2026:21289-1
Updated
2026-11-02
OSVSUSE-SU-2026:21318-1 No score

Security update for haproxy

This update for haproxy fixes the following issue:

  • CVE-2026-33555: improper validation when matching a received body length to a previously announced Content-Length can lead to request smuggling due to HTTP/3 parser desynchronization (bsc#1262103).
Record
SUSE-SU-2026:21318-1
Updated
2026-11-02
OSVSUSE-SU-2026:21353-1 No score

Security update for haproxy

This update for haproxy fixes the following issues:

Security issue:

  • CVE-2026-33555: Request smuggling via HTTP/3 parser desynchronization (bsc#1262103).
  • bug in SLZ compression (bsc#1261626).
Record
SUSE-SU-2026:21353-1
Updated
2026-11-02
OSVSUSE-SU-2026:21390-1 No score

Security update for haproxy

This update for haproxy fixes the following issues:

Security issue:

  • CVE-2026-33555: Request smuggling via HTTP/3 parser desynchronization (bsc#1262103).
  • bug in SLZ compression (bsc#1261626).
Record
SUSE-SU-2026:21390-1
Updated
2026-11-02
OSVUSN-8208-1 No score

haproxy vulnerability

Martino Spagnuolo discovered that HAProxy did not check received body lengths in the HTTP/3 parser. A remote attacker could possibly use this issue to perform a request smuggling attack and obtain sensitive information.

Record
USN-8208-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
haproxy
Azure Linux:3
 before 2.9.11-5
2.9.11-5
haproxy
Bitnami
 2.6.0 up to 3.3.6
3.3.6
haproxy
Debian:12
 before 2.6.12-1+deb12u4, plus listed versions
2.6.12-12.6.12-1+deb12u12.6.12-1+deb12u22.6.12-1+deb12u3
2.6.12-1+deb12u4
haproxy
Debian:13
 before 3.0.11-1+deb13u3, plus listed versions
3.0.11-13.0.11-1+deb13u13.0.11-1+deb13u2
3.0.11-1+deb13u3
haproxy
Debian:14
 before 3.2.15-1, plus listed versions
3.0.11-13.1.0-13.1.0-23.1.1-13.1.2-1
Show 21 moreShow less
3.1.3-13.1.5-13.1.6-13.1.7-13.2.0-13.2.1-13.2.10-13.2.11-13.2.11-23.2.12-13.2.13-13.2.14-13.2.3-13.2.3-23.2.4-13.2.5-13.2.5-23.2.6-13.2.7-13.2.8-13.2.9-1
3.2.15-1
haproxy
Mageia:9
 before 2.8.18-1.1.mga9
2.8.18-1.1.mga9
haproxy
openEuler:24.03-LTS-SP3
 before 3.0.11-2.oe2403sp3
3.0.11-2.oe2403sp3
haproxy
openEuler:22.03-LTS-SP4
 before 2.6.6-19.oe2203sp4
2.6.6-19.oe2203sp4
haproxy
openEuler:24.03-LTS
 before 2.9.5-13.oe2403
2.9.5-13.oe2403
haproxy
openEuler:24.03-LTS-SP1
 before 2.9.5-13.oe2403sp1
2.9.5-13.oe2403sp1
Show 9 moreShow less
Affected packages
PackageAffectedFixed
haproxy
Red Hat:hummingbird:1
 before 0:3.0.19-1.1.hum1
0:3.0.19-1.1.hum1
haproxy
SUSE:Linux Enterprise High Availability Extension 15 SP6
 before 2.8.11+git0.01c1056a4-150600.3.12.1
2.8.11+git0.01c1056a4-150600.3.12.1
haproxy
SUSE:Linux Enterprise High Availability Extension 15 SP7
 before 2.8.11+git0.01c1056a4-150600.3.12.1
2.8.11+git0.01c1056a4-150600.3.12.1
haproxy
SUSE:Linux Micro 6.2
 before 3.2.15+git64.0fc44b458-160000.2.1
3.2.15+git64.0fc44b458-160000.2.1
haproxy
Ubuntu:24.04:LTS
 before 2.8.16-0ubuntu0.24.04.2, plus listed versions
2.6.15-1ubuntu22.8.5-1ubuntu12.8.5-1ubuntu22.8.5-1ubuntu32.8.5-1ubuntu3.1
Show 5 moreShow less
2.8.5-1ubuntu3.22.8.5-1ubuntu3.32.8.5-1ubuntu3.42.8.15-0ubuntu0.24.04.12.8.16-0ubuntu0.24.04.1
2.8.16-0ubuntu0.24.04.2
haproxy
Ubuntu:25.10
 before 3.0.12-0ubuntu0.25.10.4, plus listed versions
3.0.8-1ubuntu13.0.8-1ubuntu1.13.0.10-1ubuntu13.0.10-1ubuntu23.0.10-1ubuntu33.0.12-0ubuntu0.25.10.13.0.12-0ubuntu0.25.10.3
3.0.12-0ubuntu0.25.10.4
haproxy
Ubuntu:26.04:LTS
 before 3.2.9-1ubuntu2.1, plus listed versions
3.0.10-1ubuntu33.2.9-1ubuntu13.2.9-1ubuntu2
3.2.9-1ubuntu2.1
haproxy
openSUSE:Tumbleweed
 before 3.3.6+git91.af5637e93-1.1
3.3.6+git91.af5637e93-1.1
haproxy
openSUSE:Leap 16.0
 before 3.2.15+git64.0fc44b458-160000.2.1
3.2.15+git64.0fc44b458-160000.2.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubr3verii/CVE-2026-335552026-04-16

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-33555 is a medium vulnerability (CVSS 4.0) in Haproxy, published April 13, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 23rd percentile. Fixed in haproxy 2.9.11-5.

References

Show 29 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open