Vulnerability-Lookup

CVE-2026-33555 (GCVE-0-2026-33555)

Vulnerability from cvelistv5 – Published: 2026-04-13 00:00 – Updated: 2026-04-22 18:43

Summary

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

Severity

4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-22 18:42 UTC

CWE

CWE-130 - Improper Handling of Length Parameter Inconsistency

Assigner

mitre mitre root

References

5 references

URL	Tags
https://www.haproxy.org
https://www.haproxy.com/documentation/haproxy-alo…
https://github.com/haproxy/haproxy/commit/05a2954…
https://www.mail-archive.com/haproxy@formilux.org…
https://r3verii.github.io/cve/2026/04/14/haproxy-…

Impacted products

1 product

Vendor	Product	Version	CPE status
HAProxy	HAProxy	Affected: 2.6 , < 3.3.6 (custom) cpe:2.3:a:haproxy:haproxy::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33555",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-22T18:42:59.239377Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-22T18:43:17.553Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "HAProxy",
          "vendor": "HAProxy",
          "versions": [
            {
              "lessThan": "3.3.6",
              "status": "affected",
              "version": "2.6",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.3.6",
                  "versionStartIncluding": "2.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-130",
              "description": "CWE-130 Improper Handling of Length Parameter Inconsistency",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-22T14:53:33.583Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.haproxy.org"
        },
        {
          "url": "https://www.haproxy.com/documentation/haproxy-aloha/changelog/"
        },
        {
          "url": "https://github.com/haproxy/haproxy/commit/05a295441c621089ffa4318daf0dbca2dd756a84"
        },
        {
          "url": "https://www.mail-archive.com/haproxy@formilux.org/msg46752.html"
        },
        {
          "url": "https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-33555",
    "datePublished": "2026-04-13T00:00:00.000Z",
    "dateReserved": "2026-03-22T00:00:00.000Z",
    "dateUpdated": "2026-04-22T18:43:17.553Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-33555",
      "date": "2026-09-19",
      "epss": "0.00297",
      "percentile": "0.22567"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "HAProxy",
                "vendor": "HAProxy",
                "versions": [
                  {
                    "lessThan": "3.3.6",
                    "status": "affected",
                    "version": "2.6",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "cve@mitre.org"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B0C66EEE-8E91-4525-9187-0FB58152B8BC",
                    "versionEndExcluding": "3.3.6",
                    "versionStartIncluding": "2.6.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6."
          }
        ],
        "id": "CVE-2026-33555",
        "lastModified": "2026-06-29T15:28:15.663",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.0,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 1.4,
              "source": "cve@mitre.org",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-33555",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-22T18:42:59.239377Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-04-13T17:16:28.237",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/haproxy/haproxy/commit/05a295441c621089ffa4318daf0dbca2dd756a84"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Release Notes"
            ],
            "url": "https://www.haproxy.com/documentation/haproxy-aloha/changelog/"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Product"
            ],
            "url": "https://www.haproxy.org"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Release Notes"
            ],
            "url": "https://www.mail-archive.com/haproxy@formilux.org/msg46752.html"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-130"
              }
            ],
            "source": "cve@mitre.org",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T17:15:57+00:00",
      "cve": "CVE-2026-33555",
      "id": "CVE-2026-33555",
      "initial_release_date": "2026-04-13T00:00:00+00:00",
      "product_status:fixed": "3",
      "product_status:known_affected": "10",
      "product_status:known_not_affected": "4",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "haproxy: HAProxy: Request smuggling via HTTP/3 parser desynchronization",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33555.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-15T05:18:49Z",
      "cve": "CVE-2026-33555",
      "id": "CVE-2026-33555",
      "initial_release_date": "2026-04-14T23:26:30Z",
      "product_status:known_not_affected": "7",
      "product_status:recommended": "9",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-33555",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-33555.json",
      "version": "10"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-33555",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-04-22T18:42:59.239377Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-04-14T13:22:34.930Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "HAProxy",
              "vendor": "HAProxy",
              "versions": [
                {
                  "lessThan": "3.3.6",
                  "status": "affected",
                  "version": "2.6",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "3.3.6",
                      "versionStartIncluding": "2.6",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 4,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-130",
                  "description": "CWE-130 Improper Handling of Length Parameter Inconsistency",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-04-22T14:53:33.583Z",
            "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            "shortName": "mitre"
          },
          "references": [
            {
              "url": "https://www.haproxy.org"
            },
            {
              "url": "https://www.haproxy.com/documentation/haproxy-aloha/changelog/"
            },
            {
              "url": "https://github.com/haproxy/haproxy/commit/05a295441c621089ffa4318daf0dbca2dd756a84"
            },
            {
              "url": "https://www.mail-archive.com/haproxy@formilux.org/msg46752.html"
            },
            {
              "url": "https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html"
            }
          ],
          "x_generator": {
            "engine": "enrichogram 0.0.1"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "assignerShortName": "mitre",
        "cveId": "CVE-2026-33555",
        "datePublished": "2026-04-13T00:00:00.000Z",
        "dateReserved": "2026-03-22T00:00:00.000Z",
        "dateUpdated": "2026-04-22T18:43:17.553Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

bit-haproxy-2026-33555

Vulnerability from bitnami_vulndb

Published

2026-06-30 23:39

Modified

2026-09-10 15:46

Summary

Details

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "haproxy",
        "purl": "pkg:bitnami/haproxy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.0"
            },
            {
              "fixed": "3.3.6"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33555"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
  },
  "details": "An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.",
  "id": "BIT-haproxy-2026-33555",
  "modified": "2026-09-10T15:46:03.895Z",
  "published": "2026-06-30T23:39:33.320Z",
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/haproxy/haproxy/commit/05a295441c621089ffa4318daf0dbca2dd756a84"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33555"
    },
    {
      "type": "ADVISORY",
      "url": "https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html"
    },
    {
      "type": "ARTICLE",
      "url": "https://www.haproxy.com/documentation/haproxy-aloha/changelog/"
    },
    {
      "type": "WEB",
      "url": "https://www.haproxy.org"
    },
    {
      "type": "ARTICLE",
      "url": "https://www.mail-archive.com/haproxy@formilux.org/msg46752.html"
    }
  ],
  "schema_version": "1.6.2"
}

CERTFR-2026-AVI-0486

Vulnerability from certfr_avis - Published: 2026-04-23 - Updated: 2026-04-23

De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Microsoft	Azure Linux	azl3 ntfs-3g 2022.10.3-2 versions antérieures à 2022.10.3-3
Microsoft	Azure Linux	azl3 openssl 3.3.5-4 versions antérieures à 3.3.7-1
Microsoft	Azure Linux	azl3 gh 2.62.0-13 versions antérieures à 2.62.0-15
Microsoft	Azure Linux	azl3 haproxy 2.9.11-4 versions antérieures à 2.9.11-5
Microsoft	Azure Linux	azl3 telegraf 1.31.0-17 versions antérieures à 1.31.0-19

References

Title

Publication Time

FKIE_CVE-2026-33555

Vulnerability from fkie_nvd - Published: 2026-04-13 17:16 - Updated: 2026-06-29 15:28

Severity

4.0 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
5.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Summary

References

URL	Tags
cve@mitre.org	https://github.com/haproxy/haproxy/commit/05a295441c621089ffa4318daf0dbca2dd756a84	Patch
cve@mitre.org	https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html	Exploit, Third Party Advisory
cve@mitre.org	https://www.haproxy.com/documentation/haproxy-aloha/changelog/	Release Notes
cve@mitre.org	https://www.haproxy.org	Product
cve@mitre.org	https://www.mail-archive.com/haproxy@formilux.org/msg46752.html	Release Notes
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html	Exploit, Third Party Advisory

Impacted products

	Vendor	Product	Version
	haproxy	haproxy	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "HAProxy",
          "vendor": "HAProxy",
          "versions": [
            {
              "lessThan": "3.3.6",
              "status": "affected",
              "version": "2.6",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0C66EEE-8E91-4525-9187-0FB58152B8BC",
              "versionEndExcluding": "3.3.6",
              "versionStartIncluding": "2.6.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6."
    }
  ],
  "id": "CVE-2026-33555",
  "lastModified": "2026-06-29T15:28:15.663",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "cve@mitre.org",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33555",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-22T18:42:59.239377Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-13T17:16:28.237",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/haproxy/haproxy/commit/05a295441c621089ffa4318daf0dbca2dd756a84"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Release Notes"
      ],
      "url": "https://www.haproxy.com/documentation/haproxy-aloha/changelog/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Product"
      ],
      "url": "https://www.haproxy.org"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Release Notes"
      ],
      "url": "https://www.mail-archive.com/haproxy@formilux.org/msg46752.html"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-130"
        }
      ],
      "source": "cve@mitre.org",
      "type": "Secondary"
    }
  ]
}

GHSA-5MP8-RQ5M-PJ7M

Vulnerability from github – Published: 2026-04-13 18:30 – Updated: 2026-04-22 18:31

Details

Severity

4.0 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-33555"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-130"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-13T17:16:28Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.",
  "id": "GHSA-5mp8-rq5m-pj7m",
  "modified": "2026-04-22T18:31:38Z",
  "published": "2026-04-13T18:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33555"
    },
    {
      "type": "WEB",
      "url": "https://github.com/haproxy/haproxy/commit/05a295441c621089ffa4318daf0dbca2dd756a84"
    },
    {
      "type": "WEB",
      "url": "https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html"
    },
    {
      "type": "WEB",
      "url": "https://www.haproxy.com/documentation/haproxy-aloha/changelog"
    },
    {
      "type": "WEB",
      "url": "https://www.haproxy.org"
    },
    {
      "type": "WEB",
      "url": "https://www.mail-archive.com/haproxy@formilux.org/msg46752.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

MSRC_CVE-2026-33555

Vulnerability from csaf_microsoft - Published: 2026-04-02 00:00 - Updated: 2026-04-29 14:57

Summary

CVE-2026-33555

Scope

1 vulnerability in this advisory, including CVE-2026-33555.

CVE-2026-33555

4.0 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Fixed: 2 products Known affected: 2 products

https://learn.microsoft.com/en-us/azure/azure-linux/tutoria…

Open the full advisory

OESA-2026-2083 (CVE-2026-33555)

Vulnerability from osv_openeuler – Published: 2026-04-25 11:11 – Updated: 2026-08-06 11:11 – Source website

Summary

haproxy security update

Details

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

Severity

4.0 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-33555	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "haproxy-3.0.11-2.oe2403sp3.aarch64.rpm",
          "haproxy-debuginfo-3.0.11-2.oe2403sp3.aarch64.rpm",
          "haproxy-debugsource-3.0.11-2.oe2403sp3.aarch64.rpm"
        ],
        "noarch": [
          "haproxy-help-3.0.11-2.oe2403sp3.noarch.rpm"
        ],
        "src": [
          "haproxy-3.0.11-2.oe2403sp3.src.rpm"
        ],
        "x86_64": [
          "haproxy-3.0.11-2.oe2403sp3.x86_64.rpm",
          "haproxy-debuginfo-3.0.11-2.oe2403sp3.x86_64.rpm",
          "haproxy-debugsource-3.0.11-2.oe2403sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP3",
        "name": "haproxy",
        "purl": "pkg:rpm/openEuler/haproxy\u0026distro=openEuler-24.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.11-2.oe2403sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world\u0026amp;apos;s most visited ones.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.(CVE-2026-33555)",
  "id": "OESA-2026-2083",
  "modified": "2026-08-06T11:11:04Z",
  "published": "2026-04-25T11:11:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2083"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33555"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "haproxy security update",
  "upstream": [
    "CVE-2026-33555"
  ]
}

OESA-2026-2084 (CVE-2026-33555)

Vulnerability from osv_openeuler – Published: 2026-04-25 11:11 – Updated: 2026-08-06 11:11 – Source website

Summary

haproxy security update

Details

Security Fix(es):

Severity

4.0 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-33555	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "haproxy-2.6.6-19.oe2203sp4.aarch64.rpm",
          "haproxy-debuginfo-2.6.6-19.oe2203sp4.aarch64.rpm",
          "haproxy-debugsource-2.6.6-19.oe2203sp4.aarch64.rpm"
        ],
        "noarch": [
          "haproxy-help-2.6.6-19.oe2203sp4.noarch.rpm"
        ],
        "src": [
          "haproxy-2.6.6-19.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "haproxy-2.6.6-19.oe2203sp4.x86_64.rpm",
          "haproxy-debuginfo-2.6.6-19.oe2203sp4.x86_64.rpm",
          "haproxy-debugsource-2.6.6-19.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "haproxy",
        "purl": "pkg:rpm/openEuler/haproxy\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.6.6-19.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world\u0026amp;apos;s most visited ones.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.(CVE-2026-33555)",
  "id": "OESA-2026-2084",
  "modified": "2026-08-06T11:11:05Z",
  "published": "2026-04-25T11:11:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2084"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33555"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "haproxy security update",
  "upstream": [
    "CVE-2026-33555"
  ]
}

OESA-2026-2085 (CVE-2026-33555)

Vulnerability from osv_openeuler – Published: 2026-04-25 11:11 – Updated: 2026-08-06 11:11 – Source website

Summary

haproxy security update

Details

Security Fix(es):

Severity

4.0 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-33555	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "haproxy-2.9.5-13.oe2403.aarch64.rpm",
          "haproxy-debuginfo-2.9.5-13.oe2403.aarch64.rpm",
          "haproxy-debugsource-2.9.5-13.oe2403.aarch64.rpm"
        ],
        "noarch": [
          "haproxy-help-2.9.5-13.oe2403.noarch.rpm"
        ],
        "src": [
          "haproxy-2.9.5-13.oe2403.src.rpm"
        ],
        "x86_64": [
          "haproxy-2.9.5-13.oe2403.x86_64.rpm",
          "haproxy-debuginfo-2.9.5-13.oe2403.x86_64.rpm",
          "haproxy-debugsource-2.9.5-13.oe2403.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS",
        "name": "haproxy",
        "purl": "pkg:rpm/openEuler/haproxy\u0026distro=openEuler-24.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.5-13.oe2403"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world\u0026amp;apos;s most visited ones.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.(CVE-2026-33555)",
  "id": "OESA-2026-2085",
  "modified": "2026-08-06T11:11:05Z",
  "published": "2026-04-25T11:11:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2085"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33555"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "haproxy security update",
  "upstream": [
    "CVE-2026-33555"
  ]
}

OESA-2026-2086 (CVE-2026-33555)

Vulnerability from osv_openeuler – Published: 2026-04-25 11:11 – Updated: 2026-08-06 11:11 – Source website

Summary

haproxy security update

Details

Security Fix(es):

Severity

4.0 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-33555	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "haproxy-2.9.5-13.oe2403sp1.aarch64.rpm",
          "haproxy-debuginfo-2.9.5-13.oe2403sp1.aarch64.rpm",
          "haproxy-debugsource-2.9.5-13.oe2403sp1.aarch64.rpm"
        ],
        "noarch": [
          "haproxy-help-2.9.5-13.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "haproxy-2.9.5-13.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "haproxy-2.9.5-13.oe2403sp1.x86_64.rpm",
          "haproxy-debuginfo-2.9.5-13.oe2403sp1.x86_64.rpm",
          "haproxy-debugsource-2.9.5-13.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "haproxy",
        "purl": "pkg:rpm/openEuler/haproxy\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.5-13.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world\u0026amp;apos;s most visited ones.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.(CVE-2026-33555)",
  "id": "OESA-2026-2086",
  "modified": "2026-08-06T11:11:05Z",
  "published": "2026-04-25T11:11:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2086"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33555"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "haproxy security update",
  "upstream": [
    "CVE-2026-33555"
  ]
}

OPENSUSE-SU-2026:10581-1

Vulnerability from csaf_opensuse - Published: 2026-04-20 00:00 - Updated: 2026-04-20 00:00

Summary

haproxy-3.3.6+git91.af5637e93-1.1 on GA media

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2026-33555.

CVE-2026-33555

4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Recommended: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-33555 (GCVE-0-2026-33555)

bit-haproxy-2026-33555

Vulnerability from bitnami_vulndb

CERTFR-2026-AVI-0486

Solutions

FKIE_CVE-2026-33555

GHSA-5MP8-RQ5M-PJ7M

MSRC_CVE-2026-33555

OESA-2026-2083 (CVE-2026-33555)

OESA-2026-2084 (CVE-2026-33555)

OESA-2026-2085 (CVE-2026-33555)

OESA-2026-2086 (CVE-2026-33555)

OPENSUSE-SU-2026:10581-1

Tags

Sightings

Nomenclature

Related by attack behaviour