Every CVE Search/ Get API key

CVE-2026-55203

HAProxy - Integer Overflow in FCGI Demux Record Length Field

9.0 CriticalFix available

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.33%Up 0.1 points since Jun 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.0

HAProxy - Integer Overflow in FCGI Demux Record Length Field

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

Record
CVE-2026-55203
CVSS 4.0
9.0 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Weakness
CWE-190
Updated
2026-11-02
EUVDEUVD-2026-37905 9.0

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

Record
EUVD-2026-37905
CVSS 4.0
9.0 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-58mj-cmhg-35rg 9.0

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the...

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

Record
GHSA-58mj-cmhg-35rg
CVSS 4.0
9.0 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Weakness
CWE-190
Updated
2026-11-02
NVD 9.0

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

Record
CVE-2026-55203
CVSS 4.0
9.0 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-190
Updated
2026-11-02
OSV 9.0

HAProxy - Integer Overflow in FCGI Demux Record Length Field

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

Record
CVE-2026-55203
CVSS 4.0
9.0 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N
Weakness
CWE-190
Updated
2026-11-04
OSVDEBIAN-CVE-2026-55203 9.1

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

Record
DEBIAN-CVE-2026-55203
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
Show 28 moreShow less
OSVOESA-2026-2794 7.5

haproxy security update

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.(CVE-2026-55203)

HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.(CVE-2026-55204)

Record
OESA-2026-2794
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:35453 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:35453
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:55679 7.5

Red Hat Security Advisory: haproxy security update

Record
RHSA-2026:55679
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:55772 7.5

Red Hat Security Advisory: haproxy security update

Record
RHSA-2026:55772
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:55800 7.5

Red Hat Security Advisory: haproxy security update

Record
RHSA-2026:55800
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:55801 7.5

Red Hat Security Advisory: haproxy security update

Record
RHSA-2026:55801
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:55802 7.5

Red Hat Security Advisory: haproxy security update

Record
RHSA-2026:55802
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:55803 7.5

Red Hat Security Advisory: haproxy security update

Record
RHSA-2026:55803
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:55679 7.5

Important: haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

  • haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)

  • haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:55679
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:55772 7.5

Important: haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

  • haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)

  • haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:55772
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-55203 9.0

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

Record
UBUNTU-CVE-2026-55203
CVSS 4.0
9.0 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Updated
2026-11-02
OSVALSA-2026:55679 No score

Important: haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

  • haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)
  • haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:55679
Updated
2026-11-02
OSVALSA-2026:55772 No score

Important: haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

  • haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)
  • haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:55772
Updated
2026-11-02
OSVAZL-90264 No score

CVE-2026-55203 affecting package haproxy for versions less than 2.9.11-7

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

Record
AZL-90264
Updated
2026-11-05
OSVBIT-haproxy-2026-55203 No score

HAProxy - Integer Overflow in FCGI Demux Record Length Field

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

Record
BIT-haproxy-2026-55203
Updated
2026-11-02
OSVCLSA-2026-1782725469 No score

haproxy: Fix of CVE-2026-55203

  • CVE-2026-55203: fix uint16_t overflow of the FCGI demux record length (drl) in mux-fcgi that allowed FastCGI framing desync; widen drl to uint32_t (backport of upstream 5985276)
Record
CLSA-2026-1782725469
Updated
2026-11-02
OSVCLSA-2026-1782744931 No score

haproxy: Fix of CVE-2026-55203

  • CVE-2026-55203: fix integer overflow in FCGI mux demux record length field by widening drl from uint16_t to uint32_t, preventing FCGI framing desynchronization triggered by malicious backends
Record
CLSA-2026-1782744931
Updated
2026-11-02
OSVMGASA-2026-0250 No score

Updated haproxy packages fix security vulnerability

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues. (CVE-2026-55203) HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service. (CVE-2026-55204)

Record
MGASA-2026-0250
Updated
2026-11-02
OSVopenSUSE-SU-2026:11090-1 No score

haproxy-3.4.0+git31.fc300e9f2-1.1 on GA media

These are all security issues fixed in the haproxy-3.4.0+git31.fc300e9f2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11090-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21245-1 No score

Security update for haproxy

This update for haproxy fixes the following issues

  • Update to version 3.2.21+git0.dbe43be37
  • CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).
  • CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).
Record
openSUSE-SU-2026:21245-1
Updated
2026-11-02
OSVSUSE-SU-2026:22515-1 No score

Security update for haproxy

This update for haproxy fixes the following issues

  • CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).
  • CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).
Record
SUSE-SU-2026:22515-1
Updated
2026-11-02
OSVSUSE-SU-2026:22544-1 No score

Security update for haproxy

This update for haproxy fixes the following issues

  • Update to version 3.2.21+git0.dbe43be37
  • CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).
  • CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).
Record
SUSE-SU-2026:22544-1
Updated
2026-11-02
OSVSUSE-SU-2026:22557-1 No score

Security update for haproxy

This update for haproxy fixes the following issues

  • Update to version 3.2.21+git0.dbe43be37
  • CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).
  • CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).
Record
SUSE-SU-2026:22557-1
Updated
2026-11-02
OSVSUSE-SU-2026:22587-1 No score

Security update for haproxy

This update for haproxy fixes the following issues

  • Update to version 3.2.21+git0.dbe43be37
  • CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).
  • CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).
Record
SUSE-SU-2026:22587-1
Updated
2026-11-02
OSVSUSE-SU-2026:22663-1 No score

Security update for haproxy

This update for haproxy fixes the following issues

  • CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).
  • CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).
Record
SUSE-SU-2026:22663-1
Updated
2026-11-02
OSVSUSE-SU-2026:2651-1 No score

Security update for haproxy

This update for haproxy fixes the following issues

  • CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).
  • CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).
Record
SUSE-SU-2026:2651-1
Updated
2026-11-02
OSVSUSE-SU-2026:2652-1 No score

Security update for haproxy

This update for haproxy fixes the following issues

  • CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).
  • CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).
Record
SUSE-SU-2026:2652-1
Updated
2026-11-02
OSVUSN-8459-1 No score

haproxy vulnerabilities

It was discovered that HAProxy incorrectly handled the FCGI demultiplexer record length field. A remote attacker could possibly use this issue to cause incorrect request routing, response smuggling, or other memory safety issues. (CVE-2026-55203)

It was discovered that HAProxy failed to validate the return value of the HPACK dynamic table defragmentation function when memory was exhausted. A remote attacker could possibly use this issue to cause HAProxy to crash, resulting in a denial of service. (CVE-2026-55204)

Record
USN-8459-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
haproxy
AlmaLinux:10
From an advisory covering 2 CVEs
 before 3.0.5-6.el10_2.2
3.0.5-6.el10_2.2
haproxy
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2.8.14-3.el9_8.2
2.8.14-3.el9_8.2
haproxy
Azure Linux:3
 before 2.9.11-7
2.9.11-7
haproxy
Bitnami
 before 2.4.36, 2.5.0 up to 2.6.30, 2.7.0 up to 2.8.25, 2.9.0 up to 3.0.24, 3.1.0 up to 3.2.20, 3.3.0 up to 3.4.1
2.4.362.6.302.8.253.0.243.2.203.4.1
haproxy
TuxCare:AlmaLinux:9.6
 before 2.4.22-4.el9.tuxcare.els2
2.4.22-4.el9.tuxcare.els2
haproxy
TuxCare:AlmaLinux:9.2
 before 2.4.17-6.el9.tuxcare.els5
2.4.17-6.el9.tuxcare.els5
haproxy
Debian:12
 All versions, plus listed versions
2.6.12-12.6.12-1+deb12u12.6.12-1+deb12u22.6.12-1+deb12u32.6.12-1+deb12u4
Show 45 moreShow less
2.6.13-12.6.14-12.6.15-12.7.0-12.7.1-12.7.2-12.7.2-22.7.3-12.7.4-12.7.5-12.7.6-12.7.7-12.7.8-12.8.0-12.8.1-12.8.2-12.8.3-12.8.4-12.8.4-22.8.5-12.9.0-12.9.1-12.9.10-12.9.11-12.9.12-12.9.2-12.9.3-12.9.4-12.9.5-12.9.6-12.9.7-12.9.8-12.9.9-13.0.0-13.0.1-13.0.10-13.0.11-13.0.2-13.0.3-13.0.4-13.0.5-13.0.6-13.0.6-23.0.6-33.0.7-1
 None known
haproxy
Debian:13
 All versions, plus listed versions
3.0.11-13.0.11-1+deb13u13.0.11-1+deb13u23.0.11-1+deb13u33.0.11-1+deb13u4
Show 45 moreShow less
3.1.0-13.1.0-23.1.1-13.1.2-13.1.3-13.1.5-13.1.6-13.1.7-13.2.0-13.2.1-13.2.10-13.2.11-13.2.11-23.2.12-13.2.13-13.2.14-13.2.15-13.2.16-13.2.17-13.2.18-13.2.19-13.2.20-13.2.21-13.2.22-13.2.23-13.2.24-13.2.25-13.2.26-13.2.3-13.2.3-23.2.4-13.2.5-13.2.5-23.2.6-13.2.7-13.2.8-13.2.9-13.3.0-13.3.1-13.3.10-13.3.2-13.3.2-23.3.3-13.3.4-13.3.5-1
 None known
haproxy
Debian:14
 before 3.2.20-1, plus listed versions
3.0.11-13.1.0-13.1.0-23.1.1-13.1.2-1
Show 26 moreShow less
3.1.3-13.1.5-13.1.6-13.1.7-13.2.0-13.2.1-13.2.10-13.2.11-13.2.11-23.2.12-13.2.13-13.2.14-13.2.15-13.2.16-13.2.17-13.2.18-13.2.19-13.2.3-13.2.3-23.2.4-13.2.5-13.2.5-23.2.6-13.2.7-13.2.8-13.2.9-1
3.2.20-1
haproxy
Mageia:10
From an advisory covering 2 CVEs
 before 3.4.2-1.2.mga10
3.4.2-1.2.mga10
Show 47 moreShow less
Affected packages
PackageAffectedFixed
haproxy
Mageia:9
From an advisory covering 2 CVEs
 before 2.8.26-1.mga9
2.8.26-1.mga9
haproxy
openEuler:20.03-LTS-SP4
From an advisory covering 2 CVEs
 before 2.2.16-10.oe2003sp4
2.2.16-10.oe2003sp4
haproxy
openEuler:22.03-LTS-SP4
From an advisory covering 2 CVEs
 before 2.6.6-20.oe2203sp4
2.6.6-20.oe2203sp4
haproxy
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 2.9.5-14.oe2403sp1
2.9.5-14.oe2403sp1
haproxy
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 3.0.11-3.oe2403sp3
3.0.11-3.oe2403sp3
haproxy
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:3.0.25-0.1.hum1
0:3.0.25-0.1.hum1
haproxy
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:3.0.5-6.el10_2.2
0:3.0.5-6.el10_2.2
haproxy-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:3.0.5-6.el10_2.2
0:3.0.5-6.el10_2.2
haproxy-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:3.0.5-6.el10_2.2
0:3.0.5-6.el10_2.2
haproxy
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:2.8.14-3.el9_8.2
0:2.8.14-3.el9_8.2
haproxy-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:2.8.14-3.el9_8.2
0:2.8.14-3.el9_8.2
haproxy-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:2.8.14-3.el9_8.2
0:2.8.14-3.el9_8.2
haproxy
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 0:3.0.5-4.el10_0.3
0:3.0.5-4.el10_0.3
haproxy-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 0:3.0.5-4.el10_0.3
0:3.0.5-4.el10_0.3
haproxy-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 0:3.0.5-4.el10_0.3
0:3.0.5-4.el10_0.3
haproxy
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 2 CVEs
 before 0:2.4.22-3.el9_4.3
0:2.4.22-3.el9_4.3
haproxy-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 2 CVEs
 before 0:2.4.22-3.el9_4.3
0:2.4.22-3.el9_4.3
haproxy-debugsource
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 2 CVEs
 before 0:2.4.22-3.el9_4.3
0:2.4.22-3.el9_4.3
haproxy
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 2 CVEs
 before 0:2.4.17-6.el9_2.5
0:2.4.17-6.el9_2.5
haproxy-debuginfo
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 2 CVEs
 before 0:2.4.17-6.el9_2.5
0:2.4.17-6.el9_2.5
haproxy-debugsource
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 2 CVEs
 before 0:2.4.17-6.el9_2.5
0:2.4.17-6.el9_2.5
haproxy
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:2.4.22-4.el9_6.3
0:2.4.22-4.el9_6.3
haproxy-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:2.4.22-4.el9_6.3
0:2.4.22-4.el9_6.3
haproxy-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:2.4.22-4.el9_6.3
0:2.4.22-4.el9_6.3
haproxy
Rocky Linux:10
From an advisory covering 2 CVEs
 before 0:3.0.5-6.el10_2.2
0:3.0.5-6.el10_2.2
haproxy
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:2.8.14-3.el9_8.2
0:2.8.14-3.el9_8.2
haproxy
SUSE:Linux Micro 6.0
From an advisory covering 2 CVEs
 before 2.8.11+git0.01c1056a4-4.1
2.8.11+git0.01c1056a4-4.1
haproxy
SUSE:Linux Micro 6.2
From an advisory covering 2 CVEs
 before 3.2.21+git0.dbe43be37-160000.1.1
3.2.21+git0.dbe43be37-160000.1.1
haproxy
SUSE:Linux Enterprise High Availability Extension 16.0
From an advisory covering 2 CVEs
 before 3.2.21+git0.dbe43be37-160000.1.1
3.2.21+git0.dbe43be37-160000.1.1
haproxy
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 3.2.21+git0.dbe43be37-160000.1.1
3.2.21+git0.dbe43be37-160000.1.1
haproxy
SUSE:Linux Micro 6.1
From an advisory covering 2 CVEs
 before 2.8.11+git0.01c1056a4-slfo.1.1_4.1
2.8.11+git0.01c1056a4-slfo.1.1_4.1
haproxy
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 2 CVEs
 before 2.4.22+git0.f8e3218e2-150400.3.28.1
2.4.22+git0.f8e3218e2-150400.3.28.1
haproxy
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 2 CVEs
 before 2.4.22+git0.f8e3218e2-150400.3.28.1
2.4.22+git0.f8e3218e2-150400.3.28.1
haproxy
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 2 CVEs
 before 2.4.22+git0.f8e3218e2-150400.3.28.1
2.4.22+git0.f8e3218e2-150400.3.28.1
haproxy
SUSE:Linux Enterprise High Availability Extension 15 SP4
From an advisory covering 2 CVEs
 before 2.4.22+git0.f8e3218e2-150400.3.28.1
2.4.22+git0.f8e3218e2-150400.3.28.1
haproxy
SUSE:Linux Enterprise High Availability Extension 15 SP5
From an advisory covering 2 CVEs
 before 2.4.22+git0.f8e3218e2-150400.3.28.1
2.4.22+git0.f8e3218e2-150400.3.28.1
haproxy
SUSE:Linux Enterprise High Availability Extension 15 SP6
From an advisory covering 2 CVEs
 before 2.8.11+git0.01c1056a4-150600.3.15.1
2.8.11+git0.01c1056a4-150600.3.15.1
haproxy
SUSE:Linux Enterprise High Availability Extension 15 SP7
From an advisory covering 2 CVEs
 before 2.8.11+git0.01c1056a4-150600.3.15.1
2.8.11+git0.01c1056a4-150600.3.15.1
haproxy
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.5.14-11.5.15-11.6.2-11.6.2-21.6.2-2ubuntu1
Show 7 moreShow less
1.6.2-2ubuntu31.6.3-11.6.3-1ubuntu0.11.6.3-1ubuntu0.21.6.3-1ubuntu0.31.6.3-1ubuntu0.3+esm11.6.3-1ubuntu0.3+esm2
 None known
haproxy
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.7.9-1ubuntu11.7.9-1ubuntu21.8.4-11.8.7-11.8.8-1
Show 13 moreShow less
1.8.8-1ubuntu0.11.8.8-1ubuntu0.21.8.8-1ubuntu0.31.8.8-1ubuntu0.41.8.8-1ubuntu0.61.8.8-1ubuntu0.71.8.8-1ubuntu0.81.8.8-1ubuntu0.91.8.8-1ubuntu0.101.8.8-1ubuntu0.111.8.8-1ubuntu0.131.8.8-1ubuntu0.13+esm21.8.8-1ubuntu0.13+esm3
 None known
haproxy
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.0.5-12.0.8-12.0.9-12.0.10-12.0.10-1ubuntu1
Show 15 moreShow less
2.0.11-1ubuntu12.0.12-1ubuntu22.0.13-1ubuntu22.0.13-22.0.13-2ubuntu0.12.0.13-2ubuntu0.22.0.13-2ubuntu0.32.0.13-2ubuntu0.52.0.29-0ubuntu12.0.29-0ubuntu1.12.0.29-0ubuntu1.32.0.31-0ubuntu0.12.0.31-0ubuntu0.22.0.31-0ubuntu0.32.0.33-0ubuntu0.1
 None known
haproxy
Ubuntu:22.04:LTS
 before 2.4.30-0ubuntu0.22.04.2, plus listed versions
2.2.9-2ubuntu22.4.8-12.4.8-2ubuntu32.4.11-1ubuntu12.4.12-1ubuntu1
Show 15 moreShow less
2.4.12-1ubuntu22.4.13-1ubuntu12.4.14-1ubuntu12.4.18-0ubuntu12.4.18-0ubuntu1.12.4.18-0ubuntu1.22.4.18-0ubuntu1.32.4.22-0ubuntu0.22.04.12.4.22-0ubuntu0.22.04.22.4.22-0ubuntu0.22.04.32.4.24-0ubuntu0.22.04.12.4.24-0ubuntu0.22.04.22.4.24-0ubuntu0.22.04.32.4.29-0ubuntu0.22.04.12.4.30-0ubuntu0.22.04.1
2.4.30-0ubuntu0.22.04.2
haproxy
Ubuntu:24.04:LTS
 before 2.8.16-0ubuntu0.24.04.3, plus listed versions
2.6.15-1ubuntu22.8.5-1ubuntu12.8.5-1ubuntu22.8.5-1ubuntu32.8.5-1ubuntu3.1
Show 6 moreShow less
2.8.5-1ubuntu3.22.8.5-1ubuntu3.32.8.5-1ubuntu3.42.8.15-0ubuntu0.24.04.12.8.16-0ubuntu0.24.04.12.8.16-0ubuntu0.24.04.2
2.8.16-0ubuntu0.24.04.3
haproxy
Ubuntu:25.10
 before 3.0.12-0ubuntu0.25.10.5, plus listed versions
3.0.8-1ubuntu13.0.8-1ubuntu1.13.0.10-1ubuntu13.0.10-1ubuntu23.0.10-1ubuntu33.0.12-0ubuntu0.25.10.13.0.12-0ubuntu0.25.10.33.0.12-0ubuntu0.25.10.4
3.0.12-0ubuntu0.25.10.5
haproxy
Ubuntu:26.04:LTS
 before 3.2.9-1ubuntu2.2, plus listed versions
3.0.10-1ubuntu33.2.9-1ubuntu13.2.9-1ubuntu23.2.9-1ubuntu2.1
3.2.9-1ubuntu2.2
haproxy
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 3.4.0+git31.fc300e9f2-1.1
3.4.0+git31.fc300e9f2-1.1
haproxy
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 3.2.21+git0.dbe43be37-160000.1.1
3.2.21+git0.dbe43be37-160000.1.1

History

History
RecordedChangedSources
affectedOSV
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-55203 is a critical vulnerability (CVSS 9.0) in Haproxy, published June 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in haproxy 2.9.11-7.

References

Show 51 moreShow less
This page doesn't list everything

Left out here: 69 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open