Skip to content
OpenAdvisories
Medium · 4.0 Public exploit CVE-2026-33555 EUVD-2026-21997GHSA-5mp8-rq5m-pj7m

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announ…

Published Apr 13, 2026 · Updated Oct 18, 2026 · Assigned by mitre

Vendor: HAProxy Product: HAProxy Package: haproxy Package: haproxy Package: haproxy Package: haproxy-3.2 Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu Ecosystem: Wolfi

Description

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

Affected products

VendorProductAffectedFixed
HAProxy HAProxy 2.6 – < 3.3.6 3.3.6

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 haproxy 3.2.15-1 —
Debian 13 haproxy 3.0.11-1+deb13u3 —
Debian 12 haproxy 2.6.12-1+deb12u4 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS haproxy 3.2.9-1ubuntu2.1 —
Ubuntu 25.10 haproxy 3.0.12-0ubuntu0.25.10.4 —
Ubuntu 24.04 LTS haproxy 2.8.16-0ubuntu0.24.04.2 —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 haproxy 3.0.19-1.1.hum1 RHSA-2026:8749

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 haproxy 2.8.11+git0.01c1056a4-150600.3.12.1 SUSE-SU-2026:1568-1
SLES 15 SP6 haproxy 2.8.11+git0.01c1056a4-150600.3.12.1 SUSE-SU-2026:1568-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 6.2 haproxy 3.2.15+git64.0fc44b458-160000.2.1 SUSE-SU-2026:21280-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed haproxy 3.3.6+git91.af5637e93-1.1 openSUSE-SU-2026:10581-1
openSUSE Leap 16.0 haproxy 3.2.15+git64.0fc44b458-160000.2.1 openSUSE-SU-2026:20618-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 haproxy 2.9.11-5 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling haproxy-3.2 3.2.15-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • r3verii/CVE-2026-33555 ★ 2 · Apr 16, 2026

    One zero-byte QUIC packet is enough to desynchronize HAProxy's backend connection pool and smuggle HTTP requests across unrelated users — even users on a completely different frontend protocol.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 6

References