{"id":"CVE-2026-33555","title":"An issue was discovered in HAProxy before 3.3.6","summary":"An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause des…","severity":"medium","cvss":4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","cwe":["CWE-130"],"vendor":"haproxy","product":"haproxy","affected":["haproxy >= 2.6.0, < 3.3.6"],"patched":["haproxy 3.3.6"],"published":"2026-04-13","updated":"2026-06-29","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33555","references":[{"url":"https://github.com/haproxy/haproxy/commit/05a295441c621089ffa4318daf0dbca2dd756a84","label":"cve@mitre.org"},{"url":"https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html","label":"cve@mitre.org"},{"url":"https://www.haproxy.com/documentation/haproxy-aloha/changelog/","label":"cve@mitre.org"},{"url":"https://www.haproxy.org","label":"cve@mitre.org"},{"url":"https://www.mail-archive.com/haproxy@formilux.org/msg46752.html","label":"cve@mitre.org"},{"url":"https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","exploit-available"],"epss":0.00297,"epssPercentile":0.22575,"ingestedAt":"2026-06-29T15:48:27.651Z","exploits":{"github":1,"githubRepos":["https://github.com/r3verii/CVE-2026-33555"],"checkedAt":"2026-09-23T07:13:59.299Z"},"exploitAvailable":true,"slug":"CVE-2026-33555","body":"## Overview\n\nAn issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.\n\n## Affected\n\n- `haproxy >= 2.6.0, < 3.3.6`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `haproxy 3.3.6`","depth":"twilight","depthScore":34,"depthScoreParts":{"impact":22,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":5108,"id":"CVE-2026-33555","ts":1788887248607,"field":"exploit_available","old":"false","new":"true"},{"seq":3991,"id":"CVE-2026-33555","ts":1788886364265,"field":"exploit_available","old":"true","new":"false"},{"seq":2806,"id":"CVE-2026-33555","ts":1788883030976,"field":"exploit_available","old":"false","new":"true"},{"seq":1835,"id":"CVE-2026-33555","ts":1788882433893,"field":"exploit_available","old":"true","new":"false"},{"seq":933,"id":"CVE-2026-33555","ts":1788881867620,"field":"exploit_available","old":"false","new":"true"}]}