p PatchFirst

CVE-2026-33555

CVE-2026-33555

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

CVSS 4.0 · Medium · EPSS 0.6% · Fix available

Published
Updated

Stack: system · web

Affected products and versions

  • haproxy

    Versions
    • ≥ 2.6, < 3.3.6: Affected (custom)

    Update to 3.3.6

  • haproxy Debian:12

    Versions
    • 2.6.12-1
    • 2.6.12-1+deb12u1
    • 2.6.12-1+deb12u2
    • 2.6.12-1+deb12u3
    Affected ranges
    • ECOSYSTEM: < 2.6.12-1+deb12u4

    Update to 2.6.12-1+deb12u4

  • haproxy Debian:13

    Versions
    • 3.0.11-1
    • 3.0.11-1+deb13u1
    • 3.0.11-1+deb13u2
    Affected ranges
    • ECOSYSTEM: < 3.0.11-1+deb13u3

    Update to 3.0.11-1+deb13u3

  • haproxy Debian:14

    Versions
    • 3.0.11-1
    • 3.1.0-1
    • 3.1.0-2
    • 3.1.1-1
    • 3.1.2-1
    • 3.1.3-1
    • 3.1.5-1
    • 3.1.6-1
    • 3.1.7-1
    • 3.2.0-1
    • 3.2.1-1
    • 3.2.10-1
    • 3.2.11-1
    • 3.2.11-2
    • 3.2.12-1
    • 3.2.13-1
    • 3.2.14-1
    • 3.2.3-1
    • 3.2.3-2
    • 3.2.4-1
    • 3.2.5-1
    • 3.2.5-2
    • 3.2.6-1
    • 3.2.7-1
    • 3.2.8-1
    • 3.2.9-1
    Affected ranges
    • ECOSYSTEM: < 3.2.15-1

    Update to 3.2.15-1

  • haproxy Ubuntu:24.04:LTS

    Versions
    • 2.6.15-1ubuntu2
    • 2.8.5-1ubuntu1
    • 2.8.5-1ubuntu2
    • 2.8.5-1ubuntu3
    • 2.8.5-1ubuntu3.1
    • 2.8.5-1ubuntu3.2
    • 2.8.5-1ubuntu3.3
    • 2.8.5-1ubuntu3.4
    • 2.8.15-0ubuntu0.24.04.1
    • 2.8.16-0ubuntu0.24.04.1
    Affected ranges
    • ECOSYSTEM: < 2.8.16-0ubuntu0.24.04.2

    Update to 2.8.16-0ubuntu0.24.04.2

  • haproxy Ubuntu:25.10

    Versions
    • 3.0.8-1ubuntu1
    • 3.0.8-1ubuntu1.1
    • 3.0.10-1ubuntu1
    • 3.0.10-1ubuntu2
    • 3.0.10-1ubuntu3
    • 3.0.12-0ubuntu0.25.10.1
    • 3.0.12-0ubuntu0.25.10.3
    Affected ranges
    • ECOSYSTEM: < 3.0.12-0ubuntu0.25.10.4

    Update to 3.0.12-0ubuntu0.25.10.4

  • haproxy Ubuntu:26.04:LTS

    Versions
    • 3.0.10-1ubuntu3
    • 3.2.9-1ubuntu1
    • 3.2.9-1ubuntu2
    Affected ranges
    • ECOSYSTEM: < 3.2.9-1ubuntu2.1

    Update to 3.2.9-1ubuntu2.1

Original sources

Check your server →