CVE-2026-55203Patch(haproxy / haproxy)

MEDIUMCVSS 9.1 · CRITICAL

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

Patch haproxy haproxy systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

haproxy CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/haproxy/haproxy/commit/5985276735777634d8c85f1d73bb7764aab0d6dd

Vendor / third-party advisories

https://www.vulncheck.com/advisories/haproxy-integer-overflow-in-fcgi-demux-record-length-field

Weakness type (CWE)

CWE-190

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

haproxy

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 3 signals
Disclosure: 1 classified signal
Peaked 1d ago at 2 mentions (2026-06-19); latest day: 2
4 total mentions across 2 days

Affected systems

Vendors

haproxy

Products

haproxy

Deep dive

Activity timeline4 mentions / 2d

Signal classification3 categories

Patch

250.0%

Active Exploitation

125.0%

Disclosure

125.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-19	2	Active Exploitation1Disclosure1
2026-06-23	2	Patch2

Full discourse4 posts

Daily CyberSecurity@Daily_CyberSec132d
Patch
Two critical HAProxy vulnerabilities threaten reverse-proxy security. These flaws allow denial of service and smuggling attacks. Patch servers immediately. #HAProxy #CyberSecurity #CVE202655203 #CVE202655204 https://securityonline.info/haproxy-vulnerabilities-cve-2026-55203 https://t.co/B83DWnpQEQ
Post summary
The tweet highlights two critical HAProxy CVEs that enable DoS and smuggling attacks, urging users to patch immediately.
030111852
12.8K followersView on X
Upwind Security MDR@UpwindMDR136d
Disclosure
🚨 CRITICAL - HAProxy FastCGI framing integer overflow desync (CVE-2026-55203) HAProxy through 3.4.0 contains an integer overflow in the FastCGI parser where the fcgi_conn drl field can wrap when contentLength is 65535 and paddingLength is 1+, causing the computed record length to become 0. This misparses FastCGI record headers and desynchronizes the framing state machine. An attacker controlling or spoofing a FastCGI backend can exploit this to corrupt request/response boundaries, triggering request routing errors and response smuggling across clients. In worst cases, malformed framing may also drive unsafe code paths that could result in memory safety issues under certain configurations. 👉 Affected: haproxy <= 3.4.0 | Upgrade to No fix yet - treat as suspicious
Post summary
The post announces a critical HAProxy integer overflow vulnerability (CVE‑2026‑55203), detailing the technical mechanics and impact, while indicating no available fix yet.
0001076
219 followersView on X
kokumօtօ@__kokumoto132d
Patch
HAProxyに重大(Critical)な脆弱性。CVE-2026-55203はCVSSv4スコア9.0で、FCGIのDemuxレコード長における整数オーバーフロー。hpack_dht_insert関数におけるヌルポインタ参照（CVE-2026-55204、CVSSv4スコア8.7）もあり、それぞれ別コミットで修正。 https://securityonline.info/haproxy-vulnerabilities-cve-2026-55203/
Post summary
The text announces critical HAProxy CVEs (CVE‑2026‑55203 and CVE‑2026‑55204), details their technical nature and CVSS scores, and confirms that patches have been committed.
00000776
7.6K followersView on X
VulDB 🛡@vuldb136d
Active Exploitation
Some increased actor activities are shown targeting HAProxy (CVE-2026-55203) https://vuldb.com/vuln/372244/cti
Post summary
The report shares that increased actor activity has been observed targeting HAProxy for CVE-2026-55203, implying real‑world exploitation but lacking specific technical or mitigation details.
0000071
2.2K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	haproxy	haproxy	-	-	-

Explore more

Back to dashboard haproxy CVEs haproxy vulnerabilities

What researchers are saying

CVE-2026-55203

Upwind Security MDR[verified]@UpwindMDRDisclosure

The post announces a critical HAProxy integer overflow vulnerability (CVE‑2026‑55203), detailing the technical mechanics and impact, while indicating no available fix yet.

kokumօtօ[verified]@__kokumotoPatch

The text announces critical HAProxy CVEs (CVE‑2026‑55203 and CVE‑2026‑55204), details their technical nature and CVSS scores, and confirms that patches have been committed.

Daily CyberSecurity@Daily_CyberSecPatch

The tweet highlights two critical HAProxy CVEs that enable DoS and smuggling attacks, urging users to patch immediately.

VulDB 🛡@vuldbActive Exploitation

The report shares that increased actor activity has been observed targeting HAProxy for CVE-2026-55203, implying real‑world exploitation but lacking specific technical or mitigation details.