CVE-2026-55203: HAProxy - Integer Overflow in FastCGI Record Length Handling
HAProxy through 3.4.0 contains an integer overflow in the FCGI demultiplexer record length handling that can desynchronize the FastCGI framing parser when a malicious backend is involved. NVD assigns a score of 9.1 and the record marks the severity as critical, but this CVE is not listed in KEV and no confirmed exploitation appears in the sources consulted. A fix is referenced in commit 5985276, and upgrading to the fixed versions in the affected ranges is the main remediation.
Overview
HAProxy through 3.4.0 contains an integer overflow in the FCGI demultiplexer record length handling, classified as CWE-190 and tracked here as CVE-2026-55203. According to the record, the overflow affects the drl field of the fcgi_conn structure and is fixed in commit 5985276, referenced in the patch commit.
Impact
The record describes a case where a malicious FastCGI backend can desynchronize the framing parser, which may lead to request routing errors, response smuggling or memory safety issues. NVD's scoring vector indicates high impact on integrity and availability and no impact on confidentiality, while VulnCheck records lower scores under other methodologies. The record does not describe the precise real-world impact in any deployment.
Affected products and versions
The record lists the product as HAProxy with the following affected ranges:
- before 2.4.36
- from 2.5 up to before 2.6.30
- from 2.7 up to before 2.8.25
- from 2.9 up to before 3.0.24
- from 3.1 up to before 3.2.20
- from 3.3 up to before 3.4.1
- through 3.4.0
The upper endpoints of these ranges (2.4.36, 2.6.30, 2.8.25, 3.0.24, 3.2.20 and 3.4.1) are the versions where the record indicates the issue is no longer present. Branches not covered by these ranges are unknown from the record.
Exploitation status
The KEV data in the record does not list this CVE, and the SSVC data marks exploitation as none and automatability as no. No confirmed exploitation appears in the sources consulted for this analysis. The record gives an EPSS probability of 0.00334 with a percentile of 0.25618.
Remediation and mitigation
- Upgrade to a release that includes commit 5985276 or a later version, selecting the fixed endpoint for your own release branch from the list above.
- Until patching is complete, limit which FastCGI backends HAProxy is allowed to use and make sure those backends are trusted and isolated.
- Validate that backends behind FastCGI are under your control and monitored, since the record ties the issue to malicious backends.
Detection guidance
- Review HAProxy logs for FastCGI framing errors, unexpected backend response behaviour or repeated protocol errors on FastCGI connections.
- Compare responses delivered to clients with the requests that produced them to spot routing mismatches, which may indicate desynchronization.
Limitations of the available information
- The record does not include a technical analysis of the overflow beyond its description, and the content of the third-party VulnCheck advisory was not reviewed for this analysis.
- Scores differ between NVD and VulnCheck, and the record does not explain the methodology behind each one.
- It is unknown whether distribution packages or vendor builds backport the fix to other branches.
Frequently asked questions
Is CVE-2026-55203 known to be actively exploited?
The record does not list this CVE in KEV, and no confirmed exploitation appears in the sources consulted for this analysis.
What is the main remediation?
Upgrade HAProxy to a release that includes commit 5985276 or later, using the fixed endpoint for your branch, and restrict FastCGI backends to trusted and isolated systems until patching is complete.
Why do the scores differ?
NVD and VulnCheck use different scoring methodologies and assessments, and the record does not explain each one in detail.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.