Vulnerability Description
HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Haproxy | Haproxy | <= 3.4.0 |
Related Weaknesses (CWE)
References
- https://github.com/haproxy/haproxy/commit/5985276735777634d8c85f1d73bb7764aab0d6Patch
- https://www.vulncheck.com/advisories/haproxy-integer-overflow-in-fcgi-demux-recoThird Party Advisory
FAQ
What is CVE-2026-55203?
CVE-2026-55203 is a vulnerability with a CVSS score of 7.5 (HIGH). HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLe...
How severe is CVE-2026-55203?
CVE-2026-55203 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-55203?
Check the references section above for vendor advisories and patch information. Affected products include: Haproxy Haproxy.