Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55203— HAProxy - Integer Overflow in FCGI Demux Record Length Field

Quick assessment

Affected
haproxy haproxy
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

HAProxy是法国HAProxy组织开源的一款开源的TCP/HTTP负载均衡服务器。该服务器提供4层、7层代理,并能支持上万级别的连接,具有高效、稳定等特点。 HAProxy 3.4.0及之前版本存在数字错误漏洞，该漏洞源于fcgi_conn结构体中drl字段存在整数溢出，当contentLength为65535且paddingLength为1或更多时，drl字段回绕至0，导致不正确的记录消耗并允许恶意FastCGI后端使FCGI帧解析器不同步，可能导致请求路由错误、响应夹带或内存安全问题。

CVSS 7.5 · High EPSS 0.33% · P25

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

VendorProduct Version RangeStatus
haproxy haproxy ≤ 3.4.0 affected
5985276735777634d8c85f1d73bb7764aab0d6dd unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55203

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
HAProxy - Integer Overflow in FCGI Demux Record Length Field
Source: CVE Program / CVE List V5
Vulnerability Description
HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5
Vulnerability Title
haproxy 数字错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HAProxy是法国HAProxy组织开源的一款开源的TCP/HTTP负载均衡服务器。该服务器提供4层、7层代理,并能支持上万级别的连接,具有高效、稳定等特点。 HAProxy 3.4.0及之前版本存在数字错误漏洞，该漏洞源于fcgi_conn结构体中drl字段存在整数溢出，当contentLength为65535且paddingLength为1或更多时，drl字段回绕至0，导致不正确的记录消耗并允许恶意FastCGI后端使FCGI帧解析器不同步，可能导致请求路由错误、响应夹带或内存安全问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
haproxy haproxy 0 ~ 3.4.0 -

II. Public POCs for CVE-2026-55203

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 9862 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-55203

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55203 (1)

Vendor Advisories for CVE-2026-55203 (1)

IV. Related Vulnerabilities

Same product: haproxy
Same vendor: haproxy
Same weakness: CWE-190

V. Comments for CVE-2026-55203

No comments yet

Leave a comment