{"id":"CVE-2026-55203","aliases":["ALSA-2026:55679","ALSA-2026:55772","AZL-90264","BIT-haproxy-2026-55203","CLSA-2026-1782725469","CLSA-2026-1782744931","DEBIAN-CVE-2026-55203","EUVD-2026-37905","GHSA-58mj-cmhg-35rg","MGASA-2026-0250","OESA-2026-2794","RHSA-2026:35453","RHSA-2026:55679","RHSA-2026:55772","RHSA-2026:55800","RHSA-2026:55801","RHSA-2026:55802","RHSA-2026:55803","RLSA-2026:55679","RLSA-2026:55772","SUSE-SU-2026:22515-1","SUSE-SU-2026:22544-1","SUSE-SU-2026:22557-1","SUSE-SU-2026:22587-1","SUSE-SU-2026:22663-1","SUSE-SU-2026:2651-1","SUSE-SU-2026:2652-1","UBUNTU-CVE-2026-55203","USN-8459-1","openSUSE-SU-2026:11090-1","openSUSE-SU-2026:21245-1"],"status":"published","title":"HAProxy - Integer Overflow in FCGI Demux Record Length Field","description":"HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.","severity":{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00334,"percentile":0.27044,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2026-06-18T16:05:20Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"haproxy","fixed_in":["2.9.11-7"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"haproxy","fixed_in":["2.4.36","2.6.30","2.8.25","3.0.24","3.2.20","3.4.1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"haproxy","fixed_in":["2.4.22-4.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"haproxy","fixed_in":["2.4.17-6.el9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"haproxy","fixed_in":["3.2.20-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"haproxy","fixed_in":["2.4.30-0ubuntu0.22.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"haproxy","fixed_in":["2.8.16-0ubuntu0.24.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"haproxy","fixed_in":["3.0.12-0ubuntu0.25.10.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"haproxy","fixed_in":["3.2.9-1ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-6.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.14-3.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.11-7"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"haproxy","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.36"},{"introduced":"2.5.0"},{"fixed":"2.6.30"},{"introduced":"2.7.0"},{"fixed":"2.8.25"},{"introduced":"2.9.0"},{"fixed":"3.0.24"},{"introduced":"3.1.0"},{"fixed":"3.2.20"},{"introduced":"3.3.0"},{"fixed":"3.4.1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22-4.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17-6.el9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.12-1","2.6.12-1+deb12u1","2.6.12-1+deb12u2","2.6.12-1+deb12u3","2.6.12-1+deb12u4","2.6.13-1","2.6.14-1","2.6.15-1","2.7.0-1","2.7.1-1","2.7.2-1","2.7.2-2","2.7.3-1","2.7.4-1","2.7.5-1","2.7.6-1","2.7.7-1","2.7.8-1","2.8.0-1","2.8.1-1","2.8.2-1","2.8.3-1","2.8.4-1","2.8.4-2","2.8.5-1","2.9.0-1","2.9.1-1","2.9.10-1","2.9.11-1","2.9.12-1","2.9.2-1","2.9.3-1","2.9.4-1","2.9.5-1","2.9.6-1","2.9.7-1","2.9.8-1","2.9.9-1","3.0.0-1","3.0.1-1","3.0.10-1","3.0.11-1","3.0.2-1","3.0.3-1","3.0.4-1","3.0.5-1","3.0.6-1","3.0.6-2","3.0.6-3","3.0.7-1","3.0.8-1","3.0.9-1","3.1.0-1","3.1.0-2","3.1.1-1","3.1.2-1","3.1.3-1","3.1.5-1","3.1.6-1","3.1.7-1","3.2.0-1","3.2.1-1","3.2.10-1","3.2.11-1","3.2.11-2","3.2.12-1","3.2.13-1","3.2.14-1","3.2.15-1","3.2.16-1","3.2.17-1","3.2.18-1","3.2.19-1","3.2.20-1","3.2.21-1","3.2.22-1","3.2.23-1","3.2.24-1","3.2.25-1","3.2.26-1","3.2.3-1","3.2.3-2","3.2.4-1","3.2.5-1","3.2.5-2","3.2.6-1","3.2.7-1","3.2.8-1","3.2.9-1","3.3.0-1","3.3.1-1","3.3.10-1","3.3.2-1","3.3.2-2","3.3.3-1","3.3.4-1","3.3.5-1","3.3.6-1","3.3.7-1","3.3.8-1","3.3.9-1","3.4.0-1","3.4.1-1","3.4.2-1","3.4.3-1","3.4.4-1","3.4.6-1","3.4.7-1"]},{"source":"osv","ecosystem":"Debian:13","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.11-1","3.0.11-1+deb13u1","3.0.11-1+deb13u2","3.0.11-1+deb13u3","3.0.11-1+deb13u4","3.1.0-1","3.1.0-2","3.1.1-1","3.1.2-1","3.1.3-1","3.1.5-1","3.1.6-1","3.1.7-1","3.2.0-1","3.2.1-1","3.2.10-1","3.2.11-1","3.2.11-2","3.2.12-1","3.2.13-1","3.2.14-1","3.2.15-1","3.2.16-1","3.2.17-1","3.2.18-1","3.2.19-1","3.2.20-1","3.2.21-1","3.2.22-1","3.2.23-1","3.2.24-1","3.2.25-1","3.2.26-1","3.2.3-1","3.2.3-2","3.2.4-1","3.2.5-1","3.2.5-2","3.2.6-1","3.2.7-1","3.2.8-1","3.2.9-1","3.3.0-1","3.3.1-1","3.3.10-1","3.3.2-1","3.3.2-2","3.3.3-1","3.3.4-1","3.3.5-1","3.3.6-1","3.3.7-1","3.3.8-1","3.3.9-1","3.4.0-1","3.4.1-1","3.4.2-1","3.4.3-1","3.4.4-1","3.4.6-1","3.4.7-1"]},{"source":"osv","ecosystem":"Debian:14","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.20-1"}]}],"versions":["3.0.11-1","3.1.0-1","3.1.0-2","3.1.1-1","3.1.2-1","3.1.3-1","3.1.5-1","3.1.6-1","3.1.7-1","3.2.0-1","3.2.1-1","3.2.10-1","3.2.11-1","3.2.11-2","3.2.12-1","3.2.13-1","3.2.14-1","3.2.15-1","3.2.16-1","3.2.17-1","3.2.18-1","3.2.19-1","3.2.3-1","3.2.3-2","3.2.4-1","3.2.5-1","3.2.5-2","3.2.6-1","3.2.7-1","3.2.8-1","3.2.9-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-1.2.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.26-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-10.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-20.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.5-14.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-3.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.25-0.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.5-6.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.5-6.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.5-6.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.14-3.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.14-3.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.14-3.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.5-4.el10_0.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.5-4.el10_0.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.5-4.el10_0.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-3.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-3.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-3.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.17-6.el9_2.5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.17-6.el9_2.5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.17-6.el9_2.5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-4.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-4.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-4.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.5-6.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.14-3.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.11+git0.01c1056a4-4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.21+git0.dbe43be37-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 16.0","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.21+git0.dbe43be37-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.21+git0.dbe43be37-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.11+git0.01c1056a4-slfo.1.1_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP5","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.11+git0.01c1056a4-150600.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.11+git0.01c1056a4-150600.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.14-1","1.5.15-1","1.6.2-1","1.6.2-2","1.6.2-2ubuntu1","1.6.2-2ubuntu3","1.6.3-1","1.6.3-1ubuntu0.1","1.6.3-1ubuntu0.2","1.6.3-1ubuntu0.3","1.6.3-1ubuntu0.3+esm1","1.6.3-1ubuntu0.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.9-1ubuntu1","1.7.9-1ubuntu2","1.8.4-1","1.8.7-1","1.8.8-1","1.8.8-1ubuntu0.1","1.8.8-1ubuntu0.2","1.8.8-1ubuntu0.3","1.8.8-1ubuntu0.4","1.8.8-1ubuntu0.6","1.8.8-1ubuntu0.7","1.8.8-1ubuntu0.8","1.8.8-1ubuntu0.9","1.8.8-1ubuntu0.10","1.8.8-1ubuntu0.11","1.8.8-1ubuntu0.13","1.8.8-1ubuntu0.13+esm2","1.8.8-1ubuntu0.13+esm3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.5-1","2.0.8-1","2.0.9-1","2.0.10-1","2.0.10-1ubuntu1","2.0.11-1ubuntu1","2.0.12-1ubuntu2","2.0.13-1ubuntu2","2.0.13-2","2.0.13-2ubuntu0.1","2.0.13-2ubuntu0.2","2.0.13-2ubuntu0.3","2.0.13-2ubuntu0.5","2.0.29-0ubuntu1","2.0.29-0ubuntu1.1","2.0.29-0ubuntu1.3","2.0.31-0ubuntu0.1","2.0.31-0ubuntu0.2","2.0.31-0ubuntu0.3","2.0.33-0ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.30-0ubuntu0.22.04.2"}]}],"versions":["2.2.9-2ubuntu2","2.4.8-1","2.4.8-2ubuntu3","2.4.11-1ubuntu1","2.4.12-1ubuntu1","2.4.12-1ubuntu2","2.4.13-1ubuntu1","2.4.14-1ubuntu1","2.4.18-0ubuntu1","2.4.18-0ubuntu1.1","2.4.18-0ubuntu1.2","2.4.18-0ubuntu1.3","2.4.22-0ubuntu0.22.04.1","2.4.22-0ubuntu0.22.04.2","2.4.22-0ubuntu0.22.04.3","2.4.24-0ubuntu0.22.04.1","2.4.24-0ubuntu0.22.04.2","2.4.24-0ubuntu0.22.04.3","2.4.29-0ubuntu0.22.04.1","2.4.30-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.16-0ubuntu0.24.04.3"}]}],"versions":["2.6.15-1ubuntu2","2.8.5-1ubuntu1","2.8.5-1ubuntu2","2.8.5-1ubuntu3","2.8.5-1ubuntu3.1","2.8.5-1ubuntu3.2","2.8.5-1ubuntu3.3","2.8.5-1ubuntu3.4","2.8.15-0ubuntu0.24.04.1","2.8.16-0ubuntu0.24.04.1","2.8.16-0ubuntu0.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-0ubuntu0.25.10.5"}]}],"versions":["3.0.8-1ubuntu1","3.0.8-1ubuntu1.1","3.0.10-1ubuntu1","3.0.10-1ubuntu2","3.0.10-1ubuntu3","3.0.12-0ubuntu0.25.10.1","3.0.12-0ubuntu0.25.10.3","3.0.12-0ubuntu0.25.10.4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.9-1ubuntu2.2"}]}],"versions":["3.0.10-1ubuntu3","3.2.9-1ubuntu1","3.2.9-1ubuntu2","3.2.9-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.30-0ubuntu0.22.04.2"}]}],"versions":["2.2.9-2ubuntu2","2.4.8-1","2.4.8-2ubuntu3","2.4.11-1ubuntu1","2.4.12-1ubuntu1","2.4.12-1ubuntu2","2.4.13-1ubuntu1","2.4.14-1ubuntu1","2.4.18-0ubuntu1","2.4.18-0ubuntu1.1","2.4.18-0ubuntu1.2","2.4.18-0ubuntu1.3","2.4.22-0ubuntu0.22.04.1","2.4.22-0ubuntu0.22.04.2","2.4.22-0ubuntu0.22.04.3","2.4.24-0ubuntu0.22.04.1","2.4.24-0ubuntu0.22.04.2","2.4.24-0ubuntu0.22.04.3","2.4.29-0ubuntu0.22.04.1","2.4.30-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.16-0ubuntu0.24.04.3"}]}],"versions":["2.6.15-1ubuntu2","2.8.5-1ubuntu1","2.8.5-1ubuntu2","2.8.5-1ubuntu3","2.8.5-1ubuntu3.1","2.8.5-1ubuntu3.2","2.8.5-1ubuntu3.3","2.8.5-1ubuntu3.4","2.8.15-0ubuntu0.24.04.1","2.8.16-0ubuntu0.24.04.1","2.8.16-0ubuntu0.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-0ubuntu0.25.10.5"}]}],"versions":["3.0.8-1ubuntu1","3.0.8-1ubuntu1.1","3.0.10-1ubuntu1","3.0.10-1ubuntu2","3.0.10-1ubuntu3","3.0.12-0ubuntu0.25.10.1","3.0.12-0ubuntu0.25.10.3","3.0.12-0ubuntu0.25.10.4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.9-1ubuntu2.2"}]}],"versions":["3.0.10-1ubuntu3","3.2.9-1ubuntu1","3.2.9-1ubuntu2","3.2.9-1ubuntu2.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0+git31.fc300e9f2-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.21+git0.dbe43be37-160000.1.1"}]}],"bundled":2}],"products":[{"vendor":"haproxy","product":"haproxy"}],"references":[{"url":"https://github.com/haproxy/haproxy/commit/5985276735777634d8c85f1d73bb7764aab0d6dd","tags":["patch","Patch","fix","article"]},{"url":"https://www.vulncheck.com/advisories/haproxy-integer-overflow-in-fcgi-demux-record-length-field","tags":["third-party-advisory","Third Party Advisory","advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55203","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-58mj-cmhg-35rg"},{"url":"https://access.redhat.com/errata/RHSA-2026:55679","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55203","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55204","tags":["report"]},{"url":"https://bugzilla.redhat.com/2490518","tags":["report"]},{"url":"https://bugzilla.redhat.com/2490522","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-55679.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55772","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-55772.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1782725469.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1782744931.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55203.json","tags":["advisory"]},{"url":"https://github.com/haproxy/haproxy","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-55203","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0250.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35748","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2794","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55204","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:35453","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_35453.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490522","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55203","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490518","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55204","tags":["advisory"]},{"url":"https://github.com/haproxy/haproxy/commit/9a6d1fe3f00d86ab4ea6ea6ea0a5d48fc058a513","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/haproxy-null-pointer-dereference-in-hpack-dht-insert-function","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55679.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55772.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55800","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55800.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55801","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55801.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55802","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55802.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55803","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55803.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:55679","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:55772","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622515-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268557","tags":["report"]},{"url":"https://bugzilla.suse.com/1268558","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55204","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622544-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622557-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622587-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622663-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262651-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262652-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-55203","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8459-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-55204","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-55203","title":"HAProxy - Integer Overflow in FCGI Demux Record Length Field","description":"HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.","status":"published","published":"2026-06-18T16:05:20.1Z","modified":"2026-07-14T21:33:57.207Z","cvss":[{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N","level":"critical","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:20:11.925815Z"}],"euvd":[{"id":"EUVD-2026-37905","description":"HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.","status":"published","published":"2026-06-18T16:05:20Z","modified":"2026-07-14T21:33:57Z","cvss":[{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N","level":"critical"}],"updated_at":"2026-11-02T18:19:58.306277Z"}],"ghsa":[{"id":"GHSA-58mj-cmhg-35rg","title":"HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the...","description":"HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.","status":"published","published":"2026-06-18T18:35:24Z","modified":"2026-06-18T18:35:31Z","cvss":[{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:08:54.452189Z"}],"nvd":[{"id":"CVE-2026-55203","description":"HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.","status":"published","published":"2026-06-18T17:16:34.373Z","modified":"2026-10-26T00:10:00.15Z","cvss":[{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"CVE-2026-55203","title":"HAProxy - Integer Overflow in FCGI Demux Record Length Field","description":"HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.","status":"published","published":"2026-06-18T16:05:20.1Z","modified":"2026-11-04T07:22:45.798771582Z","cvss":[{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-04T08:02:55.84884Z"},{"id":"DEBIAN-CVE-2026-55203","description":"HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.","status":"published","published":"2026-06-18T17:16:34.373Z","modified":"2026-10-26T12:02:58.422345142Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"OESA-2026-2794","title":"haproxy security update","description":"HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world\u0026amp;apos;s most visited ones.\r\n\r\nSecurity Fix(es):\n\nHAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure\u0026apos;s drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.(CVE-2026-55203)\n\nHAProxy through  3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.(CVE-2026-55204)","status":"published","published":"2026-06-24T11:11:43Z","modified":"2026-08-18T01:21:12.568154526Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"RHSA-2026:35453","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-17T10:08:06Z","modified":"2026-10-16T10:16:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:55679","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2026-08-18T10:21:05Z","modified":"2026-10-16T10:20:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55772","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2026-08-18T10:21:10Z","modified":"2026-10-16T10:20:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55800","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2026-08-18T10:21:11Z","modified":"2026-10-16T10:20:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55801","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2026-08-18T10:21:12Z","modified":"2026-10-16T10:20:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55802","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2026-08-18T10:21:12Z","modified":"2026-10-16T10:20:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55803","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2026-08-18T10:21:13Z","modified":"2026-10-16T10:20:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RLSA-2026:55679","title":"Important: haproxy security update","description":"The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.\n\nSecurity Fix(es):\n\n* haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)\n\n* haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-18T12:07:31.722662Z","modified":"2026-08-18T12:30:03.24626904Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:55772","title":"Important: haproxy security update","description":"The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.\n\nSecurity Fix(es):\n\n* haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)\n\n* haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-18T06:04:25.43626Z","modified":"2026-08-18T06:30:06.130379329Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-55203","description":"HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.","status":"published","published":"2026-06-19T00:00:00Z","modified":"2026-06-29T13:56:54.719512537Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N","level":"high"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"},{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N","level":"critical"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"ALSA-2026:55679","title":"Important: haproxy security update","description":"The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.  \n\nSecurity Fix(es):  \n\n  * haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)\n  * haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-10-29T11:30:38.454878871Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:55772","title":"Important: haproxy security update","description":"The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.  \n\nSecurity Fix(es):  \n\n  * haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)\n  * haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-10-29T11:32:36.644089598Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"AZL-90264","title":"CVE-2026-55203 affecting package haproxy for versions less than 2.9.11-7","description":"HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.","status":"published","published":"2026-06-18T17:16:34Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"BIT-haproxy-2026-55203","title":"HAProxy - Integer Overflow in FCGI Demux Record Length Field","description":"HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.","status":"published","published":"2026-06-29T05:40:49.435Z","modified":"2026-10-09T12:00:07.559873974Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"CLSA-2026-1782725469","title":"haproxy: Fix of CVE-2026-55203","description":"- CVE-2026-55203: fix uint16_t overflow of the FCGI demux record length (drl)\n  in mux-fcgi that allowed FastCGI framing desync; widen drl to uint32_t\n  (backport of upstream 5985276)","status":"published","published":"2026-06-29T09:31:25Z","modified":"2026-10-26T09:31:11.623499686Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782744931","title":"haproxy: Fix of CVE-2026-55203","description":"- CVE-2026-55203: fix integer overflow in FCGI mux demux record length field\n  by widening drl from uint16_t to uint32_t, preventing FCGI framing\n  desynchronization triggered by malicious backends","status":"published","published":"2026-06-29T14:55:47Z","modified":"2026-10-26T09:30:24.040793784Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"MGASA-2026-0250","title":"Updated haproxy packages fix security vulnerability","description":"HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow\nvulnerability in the fcgi_conn structure's drl field that allows buffer\nmisparse as new FCGI record headers. When contentLength is 65535 and\npaddingLength is 1 or more, the drl field wraps to 0, causing incorrect\nrecord consumption and allowing malicious FastCGI backends to desynchronize\nthe FCGI framing parser, potentially causing request routing errors, response\nsmuggling, or memory safety issues.\n(CVE-2026-55203)\nHAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer\ndereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that\nfails to validate the return value of hpack_dht_defrag() when the memory pool\nis exhausted. An attacker can trigger HPACK dynamic table insertions under\nmemory pressure to dereference a NULL pointer and crash HAProxy worker\nprocesses, causing denial of service.\n(CVE-2026-55204)\n","status":"published","published":"2026-07-14T01:55:37Z","modified":"2026-07-14T02:00:22.754711982Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11090-1","title":"haproxy-3.4.0+git31.fc300e9f2-1.1 on GA media","description":"These are all security issues fixed in the haproxy-3.4.0+git31.fc300e9f2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-22T00:00:00Z","modified":"2026-06-24T09:00:21.013948835Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21245-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues\n\n- Update to version 3.2.21+git0.dbe43be37\n- CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).\n- CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).\n","status":"published","published":"2026-07-07T10:11:42Z","modified":"2026-07-09T10:00:10.918132201Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22515-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues\n\n- CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as\n  new FCGI record headers (bsc#1268557).\n- CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).\n","status":"published","published":"2026-07-03T12:52:50Z","modified":"2026-07-09T18:24:09.533304818Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22544-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues\n\n- Update to version 3.2.21+git0.dbe43be37\n- CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).\n- CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).\n","status":"published","published":"2026-07-07T10:11:35Z","modified":"2026-07-14T18:24:37.35068066Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22557-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues\n\n- Update to version 3.2.21+git0.dbe43be37\n- CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).\n- CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).\n","status":"published","published":"2026-07-07T10:14:15Z","modified":"2026-07-15T18:24:11.211228218Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22587-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues\n\n- Update to version 3.2.21+git0.dbe43be37\n- CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).\n- CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).\n","status":"published","published":"2026-07-07T10:11:35Z","modified":"2026-07-15T18:24:13.363704144Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22663-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues\n\n- CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as\n  new FCGI record headers (bsc#1268557).\n- CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).\n","status":"published","published":"2026-07-03T12:16:57Z","modified":"2026-07-21T18:48:02.995610235Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2651-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues\n\n- CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as\n  new FCGI record headers (bsc#1268557).\n- CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).\n","status":"published","published":"2026-06-26T12:18:22Z","modified":"2026-06-27T08:45:05.20030527Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2652-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues\n\n- CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as\n  new FCGI record headers (bsc#1268557).\n- CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).\n","status":"published","published":"2026-06-26T12:21:05Z","modified":"2026-06-27T08:45:05.194328373Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"USN-8459-1","title":"haproxy vulnerabilities","description":"It was discovered that HAProxy incorrectly handled the FCGI demultiplexer\nrecord length field. A remote attacker could possibly use this issue to\ncause incorrect request routing, response smuggling, or other memory safety\nissues. (CVE-2026-55203)\n\nIt was discovered that HAProxy failed to validate the return value of the\nHPACK dynamic table defragmentation function when memory was exhausted. A\nremote attacker could possibly use this issue to cause HAProxy to crash,\nresulting in a denial of service. (CVE-2026-55204)","status":"published","published":"2026-06-22T13:55:06Z","modified":"2026-06-29T13:51:19.486170986Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}