CVE-2026-55203: HAProxy - Integer Overflow in FCGI Demux Record Length Field
HAProxy - Integer Overflow in FCGI Demux Record Length Field
Other sources
HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgiconn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.9.11-7 - Upgrade
Upgrade
HAProxyto a version that resolves this vulnerability.Patch 5985276 - Compensating control
If upgrading is not immediately possible, prevent untrusted FastCGI backends from being reachable by HAProxy (network isolation / firewall restrictions / deny direct backend access), since the vulnerability allows a malicious FastCGI backend to desynchronize FCGI framing.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55203?
The severity of CVE-2026-55203 is rated as critical with a score of 9.
How do I fix CVE-2026-55203?
To fix CVE-2026-55203, update HAProxy to version 3.4.0 or later, as patches are provided in commit 5985276.
What kind of vulnerability is CVE-2026-55203?
CVE-2026-55203 is an integer overflow vulnerability that affects the FCGI demux record length field in HAProxy.
What impact does CVE-2026-55203 have on HAProxy?
CVE-2026-55203 can lead to buffer misparsing of FCGI records, potentially creating security issues.
In which versions of HAProxy is CVE-2026-55203 found?
CVE-2026-55203 is found in HAProxy versions prior to 3.4.0.