CVE-2026-55203

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55203
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-55203.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-55203
Aliases
Downstream
Related
Published
2026-06-18T16:05:20.100Z
Modified
2026-07-21T18:29:38.907575027Z
Severity
  • 9.0 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N CVSS Calculator
Summary
HAProxy - Integer Overflow in FCGI Demux Record Length Field
Details

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

Database specific 
{
    "cwe_ids": [
        "CWE-190"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55203.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/haproxy/haproxy

Affected ranges

Type
GIT
Repo
https://github.com/haproxy/haproxy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5985276735777634d8c85f1d73bb7764aab0d6dd
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.4.0"
        }
    ],
    "cpe": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.1
v1.0.2
v1.1.0
v1.1.1
v1.1.10
v1.1.11
v1.1.12
v1.1.13
v1.1.14
v1.1.15
v1.1.16
v1.1.17
v1.1.18
v1.1.19
v1.1.2
v1.1.20
v1.1.21
v1.1.22
v1.1.23
v1.1.24
v1.1.25
v1.1.26
v1.1.27
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v1.2.0
v1.2.1
v1.2.1-pre1
v1.2.1-pre2
v1.2.1-pre3
v1.2.10
v1.2.10.1
v1.2.11
v1.2.11.1
v1.2.12
v1.2.13
v1.2.13.1
v1.2.14
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.2.5-pre1
v1.2.5-pre2
v1.2.5-pre3
v1.2.5-pre4
v1.2.5.1
v1.2.5.2
v1.2.6
v1.2.6-pre4
v1.2.6-pre5
v1.2.7
v1.2.7.1
v1.2.7rc
v1.2.8
v1.2.9
v1.3.0
v1.3.1
v1.3.10
v1.3.10.1
v1.3.10.2
v1.3.11
v1.3.11.1
v1.3.11.2
v1.3.11.3
v1.3.11.4
v1.3.12
v1.3.13
v1.3.14
v1.3.15
v1.3.16
v1.3.16-rc1
v1.3.16-rc2
v1.3.17
v1.3.18
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.3.6.1
v1.3.7
v1.3.8
v1.3.8.1
v1.3.8.2
v1.3.9
v1.4-dev0
v1.4-dev1
v1.4-dev2
v1.4-dev3
v1.4-dev4
v1.4-dev5
v1.4-dev6
v1.4-dev7
v1.4-dev8
v1.4-rc1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.5-dev10
v1.5-dev12
v1.5-dev13
v1.5-dev14
v1.5-dev15
v1.5-dev16
v1.5-dev17
v1.5-dev18
v1.5-dev19
v1.5-dev20
v1.5-dev21
v1.5-dev22
v1.5-dev23
v1.5-dev24
v1.5-dev25
v1.5-dev26
v1.5-dev8
v1.5-dev9
v1.5.0
v1.6-dev0
v1.6-dev1
v1.6-dev2
v1.6-dev3
v1.6-dev4
v1.6-dev5
v1.6-dev6
v1.6-dev7
v1.6.0
v1.7-dev0
v1.7-dev1
v1.7-dev2
v1.7-dev3
v1.7-dev4
v1.7-dev5
v1.7-dev6
v1.7.0
v1.8-dev0
v1.8-dev1
v1.8-dev2
v1.8-dev3
v1.8-rc1
v1.8-rc2
v1.8-rc3
v1.8-rc4
v1.8.0
v1.9-dev0
v1.9-dev1
v1.9-dev10
v1.9-dev11
v1.9-dev2
v1.9-dev3
v1.9-dev4
v1.9-dev5
v1.9-dev6
v1.9-dev7
v1.9-dev8
v1.9-dev9
v1.9.0
v2.*
v2.0-dev0
v2.0-dev1
v2.0-dev2
v2.0-dev3
v2.0-dev4
v2.0-dev5
v2.0-dev6
v2.0-dev7
v2.0.0
v2.1-dev0
v2.1-dev1
v2.1-dev2
v2.1-dev3
v2.1-dev4
v2.1-dev5
v2.1.0
v2.2-dev0
v2.2-dev1
v2.2-dev10
v2.2-dev11
v2.2-dev12
v2.2-dev2
v2.2-dev3
v2.2-dev4
v2.2-dev5
v2.2-dev6
v2.2-dev7
v2.2-dev8
v2.2-dev9
v2.2.0
v2.3-dev0
v2.3-dev1
v2.3-dev2
v2.3-dev3
v2.3-dev4
v2.3-dev5
v2.3-dev6
v2.3-dev7
v2.3-dev8
v2.3-dev9
v2.3.0
v2.4-dev0
v2.4-dev1
v2.4-dev10
v2.4-dev11
v2.4-dev12
v2.4-dev13
v2.4-dev14
v2.4-dev15
v2.4-dev16
v2.4-dev17
v2.4-dev18
v2.4-dev19
v2.4-dev2
v2.4-dev3
v2.4-dev4
v2.4-dev5
v2.4-dev6
v2.4-dev7
v2.4-dev8
v2.4-dev9
v2.4.0
v2.5-dev0
v2.5-dev1
v2.5-dev10
v2.5-dev11
v2.5-dev12
v2.5-dev13
v2.5-dev14
v2.5-dev15
v2.5-dev2
v2.5-dev3
v2.5-dev4
v2.5-dev5
v2.5-dev6
v2.5-dev7
v2.5-dev8
v2.5-dev9
v2.5.0
v2.6-dev0
v2.6-dev1
v2.6-dev10
v2.6-dev11
v2.6-dev12
v2.6-dev2
v2.6-dev3
v2.6-dev4
v2.6-dev5
v2.6-dev6
v2.6-dev7
v2.6-dev8
v2.6-dev9
v2.6.0
v2.7-dev0
v2.7-dev1
v2.7-dev10
v2.7-dev2
v2.7-dev3
v2.7-dev4
v2.7-dev5
v2.7-dev6
v2.7-dev7
v2.7-dev8
v2.7-dev9
v2.7.0
v2.8-dev0
v2.8-dev1
v2.8-dev10
v2.8-dev11
v2.8-dev12
v2.8-dev13
v2.8-dev2
v2.8-dev3
v2.8-dev4
v2.8-dev5
v2.8-dev6
v2.8-dev7
v2.8-dev8
v2.8-dev9
v2.8.0
v2.9-dev0
v2.9-dev1
v2.9-dev10
v2.9-dev11
v2.9-dev12
v2.9-dev2
v2.9-dev3
v2.9-dev4
v2.9-dev5
v2.9-dev6
v2.9-dev7
v2.9-dev8
v2.9-dev9
v2.9.0
v3.*
v3.0-dev0
v3.0-dev1
v3.0-dev10
v3.0-dev11
v3.0-dev12
v3.0-dev13
v3.0-dev2
v3.0-dev3
v3.0-dev4
v3.0-dev5
v3.0-dev6
v3.0-dev7
v3.0-dev8
v3.0-dev9
v3.0.0
v3.1-dev0
v3.1-dev1
v3.1-dev10
v3.1-dev11
v3.1-dev12
v3.1-dev13
v3.1-dev14
v3.1-dev2
v3.1-dev3
v3.1-dev4
v3.1-dev5
v3.1-dev6
v3.1-dev7
v3.1-dev8
v3.1-dev9
v3.1.0
v3.2-dev0
v3.2-dev1
v3.2-dev10
v3.2-dev11
v3.2-dev12
v3.2-dev13
v3.2-dev14
v3.2-dev15
v3.2-dev16
v3.2-dev17
v3.2-dev2
v3.2-dev3
v3.2-dev4
v3.2-dev5
v3.2-dev6
v3.2-dev7
v3.2-dev8
v3.2-dev9
v3.2.0
v3.3-dev0
v3.3-dev1
v3.3-dev10
v3.3-dev11
v3.3-dev12
v3.3-dev13
v3.3-dev14
v3.3-dev2
v3.3-dev3
v3.3-dev4
v3.3-dev5
v3.3-dev6
v3.3-dev7
v3.3-dev8
v3.3-dev9
v3.3.0
v3.4-dev0
v3.4-dev1
v3.4-dev10
v3.4-dev11
v3.4-dev12
v3.4-dev13
v3.4-dev14
v3.4-dev2
v3.4-dev3
v3.4-dev4
v3.4-dev5
v3.4-dev6
v3.4-dev7
v3.4-dev8
v3.4-dev9
v3.4.0
v3.5-dev0

Database specific

vanir_signatures 
[
    {
        "signature_type": "Line",
        "target": {
            "file": "src/mux_fcgi.c"
        },
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "96977972760350919949608749764941568400",
                "279486608961056297162498042069419015337",
                "329278527771316655991926612995450268630",
                "303965689733421752164327482840650665067"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/haproxy/haproxy/commit/5985276735777634d8c85f1d73bb7764aab0d6dd",
        "id": "CVE-2026-55203-e65cffc5",
        "deprecated": false
    }
]
source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-55203.json"
vanir_signatures_modified 
"2026-07-18T08:15:54Z"