CVE-2026-33555

Katalog CVE

CVSS 5.8 · Medium EPSS 0,58%

Kerentanan Improper Handling of Length Parameter Inconsistency pada haproxy. Skor CVSS 3.1 5.8 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

Rincian

Terbit di NVD

13 April 2026

Terakhir diubah

29 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-130: Improper Handling of Length Parameter Inconsistency

EPSS (30 hari)

0,58% peluang dieksploitasi; lebih tinggi dari 46,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/haproxy/haproxy/commit/05a295441c621089ffa4318daf0dbca2dd756a84 patch
• https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html exploit · advisory pihak ketiga
• https://www.haproxy.com/documentation/haproxy-aloha/changelog/ release notes
• https://www.haproxy.org product
• https://www.mail-archive.com/haproxy@formilux.org/msg46752.html release notes