HAProxy up to 3.4.0 FCGI Framing Parser drl integer overflow

Summaryinfo

A vulnerability described as problematic has been identified in HAProxy up to 3.4.0. This issue affects some unknown processing of the component FCGI Framing Parser. Executing a manipulation of the argument drl can lead to integer overflow. The identification of this vulnerability is CVE-2026-55203. The attack may be launched remotely. There is no exploit available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability has been found in HAProxy up to 3.4.0 and classified as problematic. This vulnerability affects an unknown code block of the component FCGI Framing Parser. The manipulation of the argument drl with an unknown input leads to a integer overflow vulnerability. The CWE definition for the vulnerability is CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

The weakness was shared by Tristan Madani as 5985276735777634d8c85f1d73bb7764aab0d6dd. The advisory is shared for download at github.com. This vulnerability was named CVE-2026-55203 since 06/16/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

Applying the patch 5985276735777634d8c85f1d73bb7764aab0d6dd is able to eliminate this problem. The bugfix is ready for download at github.com.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Firewall Software

Name

• HAProxy

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4.0

License

• open-source

Website

• Product: https://github.com/haproxy/haproxy/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion