{"id":"CVE-2026-33555","aliases":["AZL-82730","BIT-haproxy-2026-33555","DEBIAN-CVE-2026-33555","EUVD-2026-21997","GHSA-5mp8-rq5m-pj7m","MGASA-2026-0146","OESA-2026-2083","OESA-2026-2084","OESA-2026-2085","OESA-2026-2086","RHSA-2026:8749","SUSE-SU-2026:1568-1","SUSE-SU-2026:21280-1","SUSE-SU-2026:21289-1","SUSE-SU-2026:21318-1","SUSE-SU-2026:21353-1","SUSE-SU-2026:21390-1","UBUNTU-CVE-2026-33555","USN-8208-1","openSUSE-SU-2026:10581-1","openSUSE-SU-2026:20618-1"],"status":"published","title":"An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the...","description":"An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.","severity":{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00319,"percentile":0.25146,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-130"],"published":"2026-04-13T00:00:00Z","modified":"2026-11-04T07:22:44Z","exploits":[{"source":"pocgithub","id":"r3verii/CVE-2026-33555","title":"r3verii/CVE-2026-33555","date":"2026-04-16","url":"https://github.com/r3verii/CVE-2026-33555"}],"fixes":[{"ecosystem":"Azure Linux:3","package":"haproxy","fixed_in":["2.9.11-5"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"haproxy","fixed_in":["3.3.6"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"haproxy","fixed_in":["2.6.12-1+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"haproxy","fixed_in":["3.0.11-1+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"haproxy","fixed_in":["3.2.15-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"haproxy","fixed_in":["2.8.18-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"haproxy","fixed_in":["3.0.11-2.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"haproxy","fixed_in":["2.6.6-19.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"haproxy","fixed_in":["2.9.5-13.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"haproxy","fixed_in":["2.9.5-13.oe2403sp1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"haproxy","fixed_in":["0:3.0.19-1.1.hum1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6","package":"haproxy","fixed_in":["2.8.11+git0.01c1056a4-150600.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"haproxy","fixed_in":["2.8.11+git0.01c1056a4-150600.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"haproxy","fixed_in":["3.2.15+git64.0fc44b458-160000.2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"haproxy","fixed_in":["2.8.16-0ubuntu0.24.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"haproxy","fixed_in":["3.0.12-0ubuntu0.25.10.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"haproxy","fixed_in":["3.2.9-1ubuntu2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"haproxy","fixed_in":["3.3.6+git91.af5637e93-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"haproxy","fixed_in":["3.2.15+git64.0fc44b458-160000.2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.11-5"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"haproxy","ranges":[{"type":"SEMVER","events":[{"introduced":"2.6.0"},{"fixed":"3.3.6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.12-1+deb12u4"}]}],"versions":["2.6.12-1","2.6.12-1+deb12u1","2.6.12-1+deb12u2","2.6.12-1+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-1+deb13u3"}]}],"versions":["3.0.11-1","3.0.11-1+deb13u1","3.0.11-1+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-1"}]}],"versions":["3.0.11-1","3.1.0-1","3.1.0-2","3.1.1-1","3.1.2-1","3.1.3-1","3.1.5-1","3.1.6-1","3.1.7-1","3.2.0-1","3.2.1-1","3.2.10-1","3.2.11-1","3.2.11-2","3.2.12-1","3.2.13-1","3.2.14-1","3.2.3-1","3.2.3-2","3.2.4-1","3.2.5-1","3.2.5-2","3.2.6-1","3.2.7-1","3.2.8-1","3.2.9-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.18-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-2.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-19.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.5-13.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.5-13.oe2403sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.19-1.1.hum1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.11+git0.01c1056a4-150600.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.11+git0.01c1056a4-150600.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15+git64.0fc44b458-160000.2.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.16-0ubuntu0.24.04.2"}]}],"versions":["2.6.15-1ubuntu2","2.8.5-1ubuntu1","2.8.5-1ubuntu2","2.8.5-1ubuntu3","2.8.5-1ubuntu3.1","2.8.5-1ubuntu3.2","2.8.5-1ubuntu3.3","2.8.5-1ubuntu3.4","2.8.15-0ubuntu0.24.04.1","2.8.16-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-0ubuntu0.25.10.4"}]}],"versions":["3.0.8-1ubuntu1","3.0.8-1ubuntu1.1","3.0.10-1ubuntu1","3.0.10-1ubuntu2","3.0.10-1ubuntu3","3.0.12-0ubuntu0.25.10.1","3.0.12-0ubuntu0.25.10.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.9-1ubuntu2.1"}]}],"versions":["3.0.10-1ubuntu3","3.2.9-1ubuntu1","3.2.9-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.16-0ubuntu0.24.04.2"}]}],"versions":["2.6.15-1ubuntu2","2.8.5-1ubuntu1","2.8.5-1ubuntu2","2.8.5-1ubuntu3","2.8.5-1ubuntu3.1","2.8.5-1ubuntu3.2","2.8.5-1ubuntu3.3","2.8.5-1ubuntu3.4","2.8.15-0ubuntu0.24.04.1","2.8.16-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-0ubuntu0.25.10.4"}]}],"versions":["3.0.8-1ubuntu1","3.0.8-1ubuntu1.1","3.0.10-1ubuntu1","3.0.10-1ubuntu2","3.0.10-1ubuntu3","3.0.12-0ubuntu0.25.10.1","3.0.12-0ubuntu0.25.10.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.9-1ubuntu2.1"}]}],"versions":["3.0.10-1ubuntu3","3.2.9-1ubuntu1","3.2.9-1ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.6+git91.af5637e93-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15+git64.0fc44b458-160000.2.1"}]}]}],"products":[{"vendor":"haproxy","product":"haproxy"}],"references":[{"url":"https://www.haproxy.org","tags":["Product","web","article"]},{"url":"https://www.haproxy.com/documentation/haproxy-aloha/changelog/","tags":["Release Notes","article","web","report"]},{"url":"https://github.com/haproxy/haproxy/commit/05a295441c621089ffa4318daf0dbca2dd756a84","tags":["Patch","fix","article"]},{"url":"https://www.mail-archive.com/haproxy@formilux.org/msg46752.html","tags":["Release Notes","article","web","report"]},{"url":"https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html","tags":["exploit","Exploit","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/10/msg00036.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33555","tags":["web","advisory"]},{"url":"https://www.haproxy.com/documentation/haproxy-aloha/changelog"},{"url":"https://github.com/advisories/GHSA-5mp8-rq5m-pj7m"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33555.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-33555","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0146.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35416","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/B3PXHUYDTDFG5IIQSPNJLLIEQV4Z5WK6/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2083","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2084","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2085","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2086","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8749","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33555","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8749.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457920","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33555","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261568-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262103","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33555","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621280-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261626","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621289-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621318-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621353-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621390-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-33555","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8208-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-33555","description":"An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.","status":"published","published":"2026-04-13T00:00:00Z","modified":"2026-10-18T20:07:07.236Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-130"],"updated_at":"2026-11-02T14:20:07.609948Z"}],"euvd":[{"id":"EUVD-2026-21997","description":"An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.","status":"published","published":"2026-04-13T00:00:00Z","modified":"2026-10-18T20:07:07Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:00:00.51681Z"}],"ghsa":[{"id":"GHSA-5mp8-rq5m-pj7m","title":"An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the...","description":"An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.","status":"published","published":"2026-04-13T18:30:41Z","modified":"2026-10-18T21:35:05Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-130"],"updated_at":"2026-11-02T15:13:56.45986Z"}],"nvd":[{"id":"CVE-2026-33555","description":"An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.","status":"published","published":"2026-04-13T17:16:28.237Z","modified":"2026-10-18T20:16:48.11Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-130"],"updated_at":"2026-11-02T14:12:14.37744Z"}],"osv":[{"id":"CVE-2026-33555","description":"An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.","status":"published","published":"2026-04-13T00:00:00Z","modified":"2026-11-04T07:22:44.705018988Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-130"],"updated_at":"2026-11-04T08:02:55.84884Z"},{"id":"DEBIAN-CVE-2026-33555","description":"An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.","status":"published","published":"2026-04-13T17:16:28.237Z","modified":"2026-10-23T17:47:39.759565051Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"OESA-2026-2083","title":"haproxy security update","description":"HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world\u0026amp;apos;s most visited ones.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.(CVE-2026-33555)","status":"published","published":"2026-04-25T11:11:04Z","modified":"2026-08-18T01:19:56.342246706Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2084","title":"haproxy security update","description":"HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world\u0026amp;apos;s most visited ones.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.(CVE-2026-33555)","status":"published","published":"2026-04-25T11:11:05Z","modified":"2026-08-18T01:19:56.447509335Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2085","title":"haproxy security update","description":"HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world\u0026amp;apos;s most visited ones.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.(CVE-2026-33555)","status":"published","published":"2026-04-25T11:11:05Z","modified":"2026-08-18T01:19:56.355957569Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2086","title":"haproxy security update","description":"HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world\u0026amp;apos;s most visited ones.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.(CVE-2026-33555)","status":"published","published":"2026-04-25T11:11:05Z","modified":"2026-08-18T01:19:56.352800506Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"RHSA-2026:8749","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-26T10:05:56Z","modified":"2026-09-07T10:19:33Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"UBUNTU-CVE-2026-33555","description":"An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.","status":"published","published":"2026-04-13T17:16:00Z","modified":"2026-06-30T18:15:21.890241179Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"},{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"AZL-82730","title":"CVE-2026-33555 affecting package haproxy for versions less than 2.9.11-5","description":"An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.","status":"published","published":"2026-04-13T17:16:28Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"BIT-haproxy-2026-33555","description":"An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.","status":"published","published":"2026-06-30T23:39:33.32Z","modified":"2026-10-19T09:15:02.476140351Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"MGASA-2026-0146","title":"Updated haproxy packages fix security vulnerability","description":"The HTTP/3 parser does not check that the received body length matches a\npreviously announced content-length when the stream is closed via a\nframe with an empty payload. This can cause desynchronization issues\nwith the backend server and could be used for request smuggling.\n(CVE-2026-33555)\n","status":"published","published":"2026-05-16T23:54:18Z","modified":"2026-05-17T00:00:07.266443Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10581-1","title":"haproxy-3.3.6+git91.af5637e93-1.1 on GA media","description":"These are all security issues fixed in the haproxy-3.3.6+git91.af5637e93-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-20T00:00:00Z","modified":"2026-04-21T08:16:20.6393Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20618-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\nSecurity issue:\n\n- CVE-2026-33555: Request smuggling via HTTP/3 parser desynchronization (bsc#1262103).\n- bug in SLZ compression (bsc#1261626).\n","status":"published","published":"2026-04-23T08:09:04Z","modified":"2026-04-25T18:25:27.821516Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:1568-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issue:\n\n- CVE-2026-33555: Request smuggling via HTTP/3 parser desynchronization (bsc#1262103).\n","status":"published","published":"2026-04-23T12:11:11Z","modified":"2026-04-24T08:15:45.58656Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:21280-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\nSecurity issue:\n\n- CVE-2026-33555: Request smuggling via HTTP/3 parser desynchronization (bsc#1262103).\n- bug in SLZ compression (bsc#1261626).\n","status":"published","published":"2026-04-23T08:05:16Z","modified":"2026-04-25T18:25:15.904513Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21289-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issue:\n\n- CVE-2026-33555: improper validation when matching a received body length to a previously announced `Content-Length`\n  can lead to request smuggling due to HTTP/3 parser desynchronization (bsc#1262103).\n","status":"published","published":"2026-04-22T17:41:39Z","modified":"2026-04-28T18:24:47.774272Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21318-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issue:\n\n- CVE-2026-33555: improper validation when matching a received body length to a previously announced `Content-Length`\n  can lead to request smuggling due to HTTP/3 parser desynchronization (bsc#1262103).\n","status":"published","published":"2026-04-22T10:53:44Z","modified":"2026-04-28T18:26:17.403108Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21353-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\nSecurity issue:\n\n- CVE-2026-33555: Request smuggling via HTTP/3 parser desynchronization (bsc#1262103).\n- bug in SLZ compression (bsc#1261626).\n","status":"published","published":"2026-04-23T08:06:25Z","modified":"2026-04-29T18:23:57.265691Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21390-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues:\n\nSecurity issue:\n\n- CVE-2026-33555: Request smuggling via HTTP/3 parser desynchronization (bsc#1262103).\n- bug in SLZ compression (bsc#1261626).\n","status":"published","published":"2026-04-23T08:05:16Z","modified":"2026-04-29T18:24:01.287032Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"USN-8208-1","title":"haproxy vulnerability","description":"Martino Spagnuolo discovered that HAProxy did not check received body\nlengths in the HTTP/3 parser. A remote attacker could possibly use this\nissue to perform a request smuggling attack and obtain sensitive\ninformation.","status":"published","published":"2026-04-27T12:04:02Z","modified":"2026-06-30T18:15:54.250955142Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}