Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-55203— HAProxy - Integer Overflow in FCGI Demux Record Length Field

CVSS 7.5 · High EPSS 0.35% · P28

Possible ATT&CK Techniques 1AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

VendorProductVersion RangeStatus
haproxyhaproxy≤ 3.4.0affected
5985276735777634d8c85f1d73bb7764aab0d6ddunaffected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-55203

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
HAProxy - Integer Overflow in FCGI Demux Record Length Field
Source: CVE Program / CVE List V5
Vulnerability Description
HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5
Vulnerability Title
haproxy 数字错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HAProxy是法国HAProxy组织开源的一款开源的TCP/HTTP负载均衡服务器。该服务器提供4层、7层代理,并能支持上万级别的连接,具有高效、稳定等特点。 HAProxy 3.4.0及之前版本存在数字错误漏洞，该漏洞源于fcgi_conn结构体中drl字段存在整数溢出，当contentLength为65535且paddingLength为1或更多时，drl字段回绕至0，导致不正确的记录消耗并允许恶意FastCGI后端使FCGI帧解析器不同步，可能导致请求路由错误、响应夹带或内存安全问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
haproxyhaproxy 0 ~ 3.4.0 -

II. Public POCs for CVE-2026-55203

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium
Qwen3.6-35B-A3B · 9862 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-55203

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55203 (1)

Vendor Advisories for CVE-2026-55203 (1)

IV. Related Vulnerabilities

Same product: haproxy
Same vendor: haproxy
Same weakness: CWE-190

V. Comments for CVE-2026-55203

No comments yet

Leave a comment