CVE Feed

    Dashboard / CVE / CVE-2026-33555

    CVE-2026-33555

    An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

    Published:Apr 13, 2026
    Last Modified:Apr 22, 2026
    EPS:Apr 13, 2026
    EPSS Score:0.00011
    CVSS Score:4

    Affected Products

    Vendor
    Haproxy
    Product
    Haproxy

    Exploits

    https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.htmlhttps://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.htmlhttps://github.com/r3verii/CVE-2026-33555

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-47 Buffer Overflow via Parameter Expansion

    Related CVEs

    CVE-2026-26080 (CVSS 3.7) — HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishand…
    CVE-2026-26081 (CVSS 4.8) — HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy …
    CVE-2026-55204 (CVSS 8.7) — HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dh…
    CVE-2025-59303 (CVSS 6.4) — HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts co…
    CVE-2025-11230 (CVSS 7.5) — Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via …
    CVE-2025-32464 (CVSS 6.8) — HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer over…
    CVE-2024-53008 (CVSS 5.3) — Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If t…
    CVE-2024-49214 (CVSS 5.3) — QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT sess…
    CVE-2024-45506 (CVSS 7.5) — HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service …
    CVE-2023-45539 (CVSS 8.2) — HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sens…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High