Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-16 | 3 | Disclosure3 |
| 2026-04-17 | 1 | Disclosure1 |
| 2026-04-21 | 1 | Disclosure1 |
| 2026-05-24 | 1 | Disclosure1 |
| 2026-05-25 | 1 | Patch1 |
HAProxy HTTP/3 -> HTTP/1 Desync: Cross-Protocol Smuggling via a Standalone QUIC FIN (CVE-2026-33555) https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html
Post summary
A newly disclosed CVE‑2026‑33555 involves cross‑protocol smuggling via a standalone QUIC FIN in HAProxy's HTTP/3 implementation; technical details are provided in a linked blog post.
HAProxy HTTP/3 -> HTTP/1 Desync: Cross-Protocol Smuggling via a Standalone QUIC FIN (CVE-2026-33555) https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html
Post summary
The text discloses a new HAProxy vulnerability (CVE-2026-33555) involving cross‑protocol smuggling triggered by a standalone QUIC FIN, providing technical details but no evidence of exploitation, patching, or false‑positive status.
HAProxy HTTP/3 -> HTTP/1 Desync: Cross-Protocol Smuggling via a Standalone QUIC FIN (CVE-2026-33555) https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html
Post summary
The article announces a Desync cross‑protocol smuggling vulnerability in HAProxy’s HTTP/3 implementation that can be triggered via a Standalone QUIC FIN packet, providing technical details but no evidence of active exploitation or patches.
HAProxy HTTP/3 -> HTTP/1 Desync: Cross-Protocol Smuggling via a Standalone QUIC FIN (CVE-2026-33555) https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html https://t.co/lXBxN63IIN
Post summary
The article announces a new HAProxy vulnerability (CVE‑2026‑33555) involving cross‑protocol smuggling via a standalone QUIC FIN.
HAProxy request smuggling vuln (CVE-2026-33555) just got a Debian patch. Here's your guide Read more -> https://tinyurl.com/3sj8j4hx #Debian https://t.co/nIPGyq5u3d
Post summary
The tweet announces the release of a Debian patch for the HAProxy request smuggling vulnerability CVE‑2026‑33555 and directs readers to a guide for details.
HAProxy HTTP/3 request smuggling (CVE-2026-33555) can desync connection pools and hijack user sessions. Read more -> http://tinyurl.com/bdebyysw #Debian https://t.co/1BfggYYrKE
Post summary
The tweet discloses a new HAProxy HTTP/3 request smuggling vulnerability (CVE-2026-33555) that can desynchronize connection pools and hijack user sessions, with a link for further details.
Warning: medium severity vulnerability in #HAProxy. CVE-2026-33555 CVSS: 4.0. This flaw could be exploited for request smuggling. #Patch #Patch #Patch
Post summary
The message announces a medium‑severity vulnerability in HAProxy (CVE-2026-33555) that could enable request smuggling, providing only the CVE identifier, severity score, and attack vector, with no evidence of exploitation or remediation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | haproxy | haproxy | - | - | - |