Description
HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| haproxy | haproxy | ≤ 3.4.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | haproxy | 3.2.20-1 | — |
| Debian 13 | haproxy | No fix yet | — |
| Debian 12 | haproxy | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | haproxy | 3.2.9-1ubuntu2.2 | — |
| Ubuntu 25.10 | haproxy | 3.0.12-0ubuntu0.25.10.5 | — |
| Ubuntu 24.04 LTS | haproxy | 2.8.16-0ubuntu0.24.04.3 | — |
| Ubuntu 22.04 LTS | haproxy | 2.4.30-0ubuntu0.22.04.2 | — |
| Ubuntu 20.04 LTS | haproxy | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | haproxy | No fix yet | — |
| Ubuntu Pro 16.04 LTS | haproxy | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | haproxy | 3.0.5-6.el10_2.2 | RHSA-2026:55679 |
| RHEL 9 | haproxy | 2.8.14-3.el9_8.2 | RHSA-2026:55772 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | haproxy | 3.0.5-4.el10_0.3 | RHSA-2026:55800 |
| RHEL 9.6 EUS | haproxy | 2.4.22-4.el9_6.3 | RHSA-2026:55803 |
| RHEL 9.4 E4S | haproxy | 2.4.22-3.el9_4.3 | RHSA-2026:55801 |
| RHEL 9.2 E4S | haproxy | 2.4.17-6.el9_2.5 | RHSA-2026:55802 |
| Red Hat Hardened Images 1 | haproxy | 3.0.25-0.1.hum1 | RHSA-2026:35453 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | haproxy | 3.0.5-6.el10_2.2 | ALSA-2026:55679 |
| AlmaLinux 9 | haproxy | 2.8.14-3.el9_8.2 | ALSA-2026:55772 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | haproxy | 3.0.5-6.el10_2.2 | RLSA-2026:55679 |
| Rocky Linux 9 | haproxy | 2.8.14-3.el9_8.2 | RLSA-2026:55772 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | haproxy | 2.8.11+git0.01c1056a4-150600.3.15.1 | SUSE-SU-2026:2652-1 |
| SLES 15 SP6 | haproxy | 2.8.11+git0.01c1056a4-150600.3.15.1 | SUSE-SU-2026:2652-1 |
| SLES 15 SP5 | haproxy | 2.4.22+git0.f8e3218e2-150400.3.28.1 | SUSE-SU-2026:2651-1 |
| SLES 15 SP4 | haproxy | 2.4.22+git0.f8e3218e2-150400.3.28.1 | SUSE-SU-2026:2651-1 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | haproxy | 3.2.21+git0.dbe43be37-160000.1.1 | SUSE-SU-2026:22587-1 |
| SLES 16.0 | haproxy | 3.2.21+git0.dbe43be37-160000.1.1 | SUSE-SU-2026:22557-1 |
| SLE Micro 6.2 | haproxy | 3.2.21+git0.dbe43be37-160000.1.1 | SUSE-SU-2026:22544-1 |
| SLE Micro 6.1 | haproxy | 2.8.11+git0.01c1056a4-slfo.1.1_4.1 | SUSE-SU-2026:22663-1 |
| SLE Micro 6.0 | haproxy | 2.8.11+git0.01c1056a4-4.1 | SUSE-SU-2026:22515-1 |
| SLE Micro 5.5 | haproxy | 2.4.22+git0.f8e3218e2-150400.3.28.1 | SUSE-SU-2026:2651-1 |
| SLE Micro 5.4 | haproxy | 2.4.22+git0.f8e3218e2-150400.3.28.1 | SUSE-SU-2026:2651-1 |
| SLE Micro 5.3 | haproxy | 2.4.22+git0.f8e3218e2-150400.3.28.1 | SUSE-SU-2026:2651-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | haproxy | 3.4.0+git31.fc300e9f2-1.1 | openSUSE-SU-2026:11090-1 |
| openSUSE Leap 16.0 | haproxy | 3.2.21+git0.dbe43be37-160000.1.1 | openSUSE-SU-2026:21245-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | haproxy | 2.9.11-7 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | haproxy | 3.0.5-6.el10_2.2 | ELSA-2026-55679 |
| Oracle Linux 9 | haproxy | 2.8.14-3.el9_8.2 | ELSA-2026-55772 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | haproxy-3.2 | 3.2.20-r0 | — |
| Wolfi rolling | haproxy-3.3 | 3.3.11-r0 | — |
Advisories 23
- WID-SEC-2026-2012 HAProxy: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026
- ALSA-2026:55772 Important: haproxy security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:55679 Important: haproxy security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:55803 Red Hat Security Advisory: haproxy security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:55801 Red Hat Security Advisory: haproxy security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:55802 Red Hat Security Advisory: haproxy security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:55800 Red Hat Security Advisory: haproxy security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:55679 Red Hat Security Advisory: haproxy security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:55772 Red Hat Security Advisory: haproxy security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:35453 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RLSA-2026:55679 Important: haproxy security update Rocky Linux Security Advisories · Aug 18, 2026
- RLSA-2026:55772 Important: haproxy security update Rocky Linux Security Advisories · Aug 18, 2026
- ELSA-2026-55679 Important: haproxy security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 17, 2026
- ELSA-2026-55772 Important: haproxy security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 17, 2026
- SUSE-SU-2026:22663-1 Security update for haproxy SUSE / openSUSE Security Updates · Jul 21, 2026
- SUSE-SU-2026:22587-1 Security update for haproxy SUSE / openSUSE Security Updates · Jul 15, 2026
- SUSE-SU-2026:22557-1 Security update for haproxy SUSE / openSUSE Security Updates · Jul 15, 2026
- SUSE-SU-2026:22544-1 Security update for haproxy SUSE / openSUSE Security Updates · Jul 14, 2026
- SUSE-SU-2026:22515-1 Security update for haproxy SUSE / openSUSE Security Updates · Jul 9, 2026
- openSUSE-SU-2026:21245-1 Security update for haproxy SUSE / openSUSE Security Updates · Jul 9, 2026
- SUSE-SU-2026:2651-1 Security update for haproxy SUSE / openSUSE Security Updates · Jun 27, 2026
- SUSE-SU-2026:2652-1 Security update for haproxy SUSE / openSUSE Security Updates · Jun 27, 2026
- openSUSE-SU-2026:11090-1 haproxy-3.4.0+git31.fc300e9f2-1.1 on GA media SUSE / openSUSE Security Updates · Jun 24, 2026
References
- Patch Commit patch
- https://www.vulncheck.com/advisories/haproxy-integer-overflow-in-fcgi-demux-record-length-field third-party-advisory