kritisch
CVE-2026-55203
haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Red Hat7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Bitnami9.0CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Bitnami. Niedriger laut Red Hat (hoch), AlmaLinux (hoch), Azure Linux (hoch), Oracle (hoch), Rocky Linux (hoch), Ubuntu (mittel).
Beschreibung
HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | haproxy | 2.4.36, 2.6.30, 2.8.25, 3.0.24, 3.2.20, 3.4.1 |
| alma 10 | haproxy | 3.0.5-6.el10_2.2 |
| alma 9 | haproxy | 2.8.14-3.el9_8.2 |
| Azure Linux 3.0 | haproxy | 0:2.9.11-7.azl3 |
| chainguard | haproxy-2.4, haproxy-2.6, haproxy-2.8 und 3 weitere | 2.4.36-r0 und 5 weitere |
| debian 11 | haproxy | kein Fix angegeben |
| debian 12 | haproxy | kein Fix angegeben |
| debian 13 | haproxy | kein Fix angegeben |
| debian 14 | haproxy | 3.2.20-1 |
| echo | haproxy | kein Fix angegeben |
| minimos | haproxy-2.6, haproxy-2.8, haproxy-3.0 und 2 weitere | 2.6.30-r0 und 4 weitere |
| Oracle Linux 9 | haproxy | 2.8.14-3.el9_8.2 |
Alle 49 Einträge aus 34 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | haproxy | 2.4.36, 2.6.30, 2.8.25, 3.0.24, 3.2.20, 3.4.1 |
| alma 10 | haproxy | 3.0.5-6.el10_2.2 |
| alma 9 | haproxy | 2.8.14-3.el9_8.2 |
| Azure Linux 3.0 | haproxy | 0:2.9.11-7.azl3 |
| chainguard | haproxy-2.4 | 2.4.36-r0 |
| chainguard | haproxy-2.6 | 2.6.31-r0 |
| chainguard | haproxy-2.8 | 2.8.26-r0 |
| chainguard | haproxy-3.0 | 3.0.24-r0 |
| chainguard | haproxy-3.2 | 3.2.20-r0 |
| chainguard | haproxy-3.3 | 3.3.11-r0 |
| debian 11 | haproxy | kein Fix angegeben |
| debian 12 | haproxy | kein Fix angegeben |
| debian 13 | haproxy | kein Fix angegeben |
| debian 14 | haproxy | 3.2.20-1 |
| echo | haproxy | kein Fix angegeben |
| minimos | haproxy-2.6 | 2.6.30-r0 |
| minimos | haproxy-2.8 | 2.8.25-r0 |
| minimos | haproxy-3.0 | 3.0.24-r0 |
| minimos | haproxy-3.2 | 3.2.20-r0 |
| minimos | haproxy-3.4 | 3.4.1-r0 |
| Oracle Linux 9 | haproxy | 2.8.14-3.el9_8.2 |
| rapidfort alma 10 | haproxy | 3.0.5-6.el10_2.2 |
| rapidfort alma 9 | haproxy | 2.8.14-3.el9_8.2 |
| rapidfort alpine 3.20 | haproxy | 3.0.24-r0 |
| rapidfort alpine 3.21 | haproxy | 3.0.24-r0 |
| rapidfort amazon linux 2023 | haproxy | 3.0.23-2.amzn2023.0.1 |
| rapidfort debian 12 | haproxy | 0:3.2.20-1 |
| rapidfort debian 13 | haproxy | 0:3.2.20-1 |
| rapidfort fedora 43 | haproxy | 3.0.24-1.fc43 |
| rapidfort Oracle Linux 10 | haproxy | 0:3.0.5-6.el10_2.2 |
| rapidfort Oracle Linux 9 | haproxy | 0:2.8.14-3.el9_8.2 |
| rapidfort rocky 9 | haproxy | 0:2.8.14-3.el9_8.2 |
| rapidfort ubuntu 20.04 | haproxy | 0:2.4.30-0ubuntu0.22.04.2, 0:2.8.16-0ubuntu0.24.04.3, 0:3.2.9-1ubuntu2.2 |
| rapidfort ubuntu 22.04 | haproxy | 0:2.4.30-0ubuntu0.22.04.2, 0:2.8.16-0ubuntu0.24.04.3, 0:3.2.9-1ubuntu2.2 |
| rapidfort ubuntu 24.04 | haproxy | 0:2.4.30-0ubuntu0.22.04.2, 0:2.8.16-0ubuntu0.24.04.3, 0:3.2.9-1ubuntu2.2 |
| Red Hat | haproxy | kein Fix angegeben |
| Red Hat | haproxy28 | kein Fix angegeben |
| Red Hat | rhceph-ci/haproxy | kein Fix angegeben |
| Red Hat | rhceph/rhceph-haproxy-rhel10 | kein Fix angegeben |
| Red Hat | rhceph/rhceph-haproxy-rhel8 | kein Fix angegeben |
| Red Hat | rhceph/rhceph-haproxy-rhel9 | kein Fix angegeben |
| rocky 10 | haproxy | 0.0.0 |
| rocky 9 | haproxy | 2.8.14-3.el9_8.2 |
| ubuntu 22.04 | haproxy | 2.4.30-0ubuntu0.22.04.2 |
| ubuntu 24.04 | haproxy | 2.8.16-0ubuntu0.24.04.3 |
| ubuntu 25.10 | haproxy | 3.0.12-0ubuntu0.25.10.5 |
| ubuntu 26.04 | haproxy | 3.2.9-1ubuntu2.2 |
| wolfi | haproxy-3.2 | 3.2.20-r0 |
| wolfi | haproxy-3.3 | 3.3.11-r0 |
Referenzen
- https://access.redhat.com/errata/RHSA-2026:55772
- https://access.redhat.com/security/cve/CVE-2026-55203
- https://bugzilla.redhat.com/2490518
- https://bugzilla.redhat.com/2490522
- https://bugzilla.redhat.com/show_bug.cgi?id=2490518
- https://bugzilla.redhat.com/show_bug.cgi?id=2490522
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55203
Alle 18 Referenzen
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55204
- https://errata.almalinux.org/9/ALSA-2026-55772.html
- https://errata.rockylinux.org/RLSA-2026:55772
- https://github.com/haproxy/haproxy/commit/5985276735777634d8c85f1d73bb7764aab0d6dd
- https://linux.oracle.com/cve/CVE-2026-55203.html
- https://linux.oracle.com/errata/ELSA-2026-55772.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-55203
- https://ubuntu.com/security/notices/USN-8459-1
- https://www.cve.org/CVERecord?id=CVE-2026-55203
- https://www.vulncheck.com/advisories/haproxy-integer-overflow-in-fcgi-demux-record-length-field