IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
7.5Alta

CVE-2026-55203HAProxy - Integer Overflow in FCGI Demux Record Length Field

haproxy haproxy Publicada: (hace 4 meses)

Descripción

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

Debilidad (CWE): CWE-190

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
haproxy aloha ≤ 3.4.0
haproxy haproxy ≤ 3.4.0

Referencias y parches

Coincidencias CPE (NVD) (6)
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* < 2.4.36
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* ≥ 2.5 < 2.6.30
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* ≥ 2.7 < 2.8.25
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* ≥ 2.9 < 3.0.24
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* ≥ 3.1 < 3.2.20
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* ≥ 3.3 < 3.4.1

CVE recientes del mismo producto — HAProxy

7.5Alta
CVE-2026-110353
HAProxy HAProxy; HAProxy HAProxy Enterprise Edition; HAProxy Kubernetes Ingress Controller; Haproxy Kubernetes Ingress Controller Enterprise

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handler…

7.5Alta
CVE-2026-110354
HAProxy HAProxy; HAProxy HAProxy Enterprise Edition; HAProxy Technologies HAProxy Kubernetes Ingress Controller; HAProxy Technologies Kubernetes Ingress Controller Enterprise

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeat…

7.5Alta
CVE-2026-90678
HAProxy HAProxy

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend …

3.7Baja
CVE-2026-26080
HAProxy HAProxy

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.

4.8Media
CVE-2026-26081
HAProxy HAProxy

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.