PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-33555 HAProxy CVE debrief

CVE-2026-33555 is a vulnerability in HAProxy's HTTP/3 parser. The parser does not check if the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This oversight can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version of HAProxy is 2.6.0. This issue was addressed in HAProxy version 3.3.6. The vulnerability has a CVSS score of 4, indicating a medium severity level.

Vendor
HAProxy
Product
Unknown
CVSS
MEDIUM 4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-13
Original CVE updated
2026-06-29
Advisory published
2026-04-13
Advisory updated
2026-06-29

Who should care

Organizations using HAProxy versions between 2.6.0 and 3.3.6 should be aware of this vulnerability. This includes anyone who has not upgraded to version 3.3.6 or later. Given the potential for request smuggling, defenders should prioritize patching, especially if they handle sensitive data or have high security requirements.

Technical summary

The vulnerability exists in the HTTP/3 parser of HAProxy. Specifically, when a stream is closed with a frame that has an empty payload, the parser fails to verify if the received body length aligns with a previously announced content-length. This mismatch can lead to desynchronization between HAProxy and the backend server. An attacker could exploit this by smuggling requests, potentially bypassing security controls or leading to unauthorized access.

Defensive priority

Defenders should prioritize patching HAProxy to version 3.3.6 or later. In the interim, monitoring for unusual traffic patterns or backend server anomalies can help detect potential exploitation attempts.

Recommended defensive actions

  • Upgrade HAProxy to version 3.3.6 or later.
  • Monitor HAProxy and backend server logs for unusual activity.
  • Review and update security controls to account for potential request smuggling.
  • Implement additional monitoring to detect anomalies in traffic patterns.
  • Consider compensating controls if patching is not immediately feasible.

Evidence notes

The CVE record and NVD detail provide comprehensive information about the vulnerability. Additional sources, including a detailed analysis of the exploit and mitigation strategies, are available. The earliest affected version is confirmed as 2.6.0, and the fix is included in version 3.3.6.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-33555 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-33555

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-33555 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-33555

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.