An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.
Fix
Public exploits 1
- r3verii/CVE-2026-33555 PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 1
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.8 · haproxyNVD modified 2026-10-18 20:16
Affected (CPE criteria) 1
cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*
References 7
- https://github.com/haproxy/haproxy/commit/05a295441c621089ffa4318daf0dbca2dd756a84 Patch
- https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html Exploit, Third Party Advisory
- https://www.haproxy.com/documentation/haproxy-aloha/changelog/ Release Notes
- https://www.haproxy.org Product
- https://www.mail-archive.com/[email protected]/msg46752.html Release Notes
- https://lists.debian.org/debian-lts-announce/2026/10/msg00036.html
- https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html Exploit, Third Party Advisory