# CVE-2026-55203: HAProxy - Integer Overflow in FCGI Demux Record Length Field CVE-2026-55203 is fixed in 2 products on 1 platform, first by RHSA-2026:55800, released June 18, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-55203 - Priority: High - CVSS: 9.1 (Important) - EPSS: 0.0033 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jun 18, 2026 - Weakness: Integer Overflow or Wraparound - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55203 ## Description HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | haproxy Debian 14 | 3.2.20-1 | [DEBIAN-CVE-2026-55203](https://patchblox.com/security/data/fix/linux/debian-cve-2026-55203.md) | Jun 29, 2026 | | Linux | haproxy RHEL 10 | 3.0.5-4.el10_0.3 | [RHSA-2026:55800](https://patchblox.com/security/data/fix/linux/rhsa-2026-55800.md) | Jun 18, 2026 | | Linux | haproxy RHEL 9 | 0:2.8.14-3.el9_8.2 | [RHSA-2026:55772](https://patchblox.com/security/data/fix/linux/rhsa-2026-55772.md) | Aug 19, 2026 | | Linux | haproxy Ubuntu 22.04.1 LTS (jammy) | 2.4.30-0ubuntu0.22.04.2 | [haproxy 2.4.30-0ubuntu0.22.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-haproxy-2.4.30-0ubuntu0.22.04.2.md) | Jun 24, 2026 | | Linux | haproxy Ubuntu 24.04.5 LTS (noble) | 2.8.16-0ubuntu0.24.04.3 | [haproxy 2.8.16-0ubuntu0.24.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-haproxy-2.8.16-0ubuntu0.24.04.3.md) | Jun 24, 2026 | | Linux | haproxy Ubuntu 25.10 (questing) | 3.0.12-0ubuntu0.25.10.5 | [haproxy 3.0.12-0ubuntu0.25.10.5](https://patchblox.com/security/data/fix/linux/ubuntu-questing-haproxy-3.0.12-0ubuntu0.25.10.5.md) | Jun 24, 2026 | | Linux | haproxy Ubuntu 26.04.1 LTS (resolute) | 3.2.9-1ubuntu2.2 | [haproxy 3.2.9-1ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-haproxy-3.2.9-1ubuntu2.2.md) | Jun 18, 2026 | | Linux | haproxy almalinux 10 | 3.0.5-6.el10_2.2 | [ALSA-2026:55679](https://patchblox.com/security/data/fix/linux/alsa-2026-55679.md) | Aug 17, 2026 | | Linux | haproxy almalinux 9 | 2.8.14-3.el9_8.2 | [ALSA-2026:55772](https://patchblox.com/security/data/fix/linux/alsa-2026-55772.md) | Aug 17, 2026 | | Linux | haproxy ol 10 | 0:3.0.5-6.el10_2.2 | [ELSA-2026-55679](https://patchblox.com/security/data/fix/linux/elsa-2026-55679.md) | Aug 17, 2026 | | Linux | haproxy ol 9 | 0:2.8.14-3.el9_8.2 | [ELSA-2026-55772](https://patchblox.com/security/data/fix/linux/elsa-2026-55772.md) | Aug 17, 2026 | | Linux | haproxy opensuse-leap 16.0 | 3.2.21+git0.dbe43be37-160000.1.1 | [OPENSUSE-SU-2026:21245-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21245-1.md) | Jul 7, 2026 | | Linux | haproxy rocky 10 | 0:3.0.5-6.el10_2.2 | [RLSA-2026:55679](https://patchblox.com/security/data/fix/linux/rlsa-2026-55679.md) | Aug 18, 2026 | | Linux | haproxy rocky 9 | 0:2.8.14-3.el9_8.2 | [RLSA-2026:55772](https://patchblox.com/security/data/fix/linux/rlsa-2026-55772.md) | Aug 18, 2026 | | Linux | haproxy sles 15.6 | 2.8.11+git0.01c1056a4-150600.3.15.1 | [SUSE-SU-2026:2652-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2652-1.md) | Jun 26, 2026 | | Linux | haproxy sles 15.7 | 2.8.11+git0.01c1056a4-150600.3.15.1 | [SUSE-SU-2026:2652-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2652-1.md) | Jun 26, 2026 | | Linux | haproxy sles 16.0 | 3.2.21+git0.dbe43be37-160000.1.1 | [SUSE-SU-2026:22557-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22557-1.md) | Jul 7, 2026 | | Linux | vim-haproxy Ubuntu 22.04.1 LTS (jammy) | 2.4.30-0ubuntu0.22.04.2 | [vim-haproxy 2.4.30-0ubuntu0.22.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-vim-haproxy-2.4.30-0ubuntu0.22.04.2.md) | Jun 24, 2026 | | Linux | vim-haproxy Ubuntu 24.04.5 LTS (noble) | 2.8.16-0ubuntu0.24.04.3 | [vim-haproxy 2.8.16-0ubuntu0.24.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-vim-haproxy-2.8.16-0ubuntu0.24.04.3.md) | Jun 24, 2026 | | Linux | vim-haproxy Ubuntu 25.10 (questing) | 3.0.12-0ubuntu0.25.10.5 | [vim-haproxy 3.0.12-0ubuntu0.25.10.5](https://patchblox.com/security/data/fix/linux/ubuntu-questing-vim-haproxy-3.0.12-0ubuntu0.25.10.5.md) | Jun 24, 2026 | | Linux | vim-haproxy Ubuntu 26.04.1 LTS (resolute) | 3.2.9-1ubuntu2.2 | [vim-haproxy 3.2.9-1ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-vim-haproxy-3.2.9-1ubuntu2.2.md) | Jun 18, 2026 | --- Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.