CVE-2026-55203: HAProxy - Integer Overflow in FCGI Demux Record Length Field

Synopsis

An integer overflow vulnerability in HAProxy's FastCGI (FCGI) demultiplexer allows a malicious or compromised FastCGI backend to desynchronize HAProxy's FCGI framing parser. The vulnerability is reachable over the network with no authentication required, as described by the CVSS:4.0 vector (AV:N/PR:N). Successful exploitation enables response smuggling, request routing errors, or memory safety violations that compromise the integrity of upstream and downstream traffic. A patched-image rebuild at commit 5985276 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable FCGI demux path is exercised over the network; an attacker must be able to control or compromise a FastCGI backend reachable by the HAProxy instance.

• AuthenticationNot required

  No authentication is required to trigger the vulnerability; the malicious FCGI backend communicates over the existing backend connection without any credential barrier.

• Victim interactionNot required

  No user or operator action is needed; exploitation occurs through crafted FCGI responses sent passively by the backend.

• Attack complexityDetail

  The CVSS vector specifies AC:L (low complexity) but also AT:P (attack requirements: present), meaning the exploit is straightforward to craft once the attacker controls a FastCGI backend, though that prerequisite must be satisfied.

Blast Radius

• An attacker who controls a FastCGI backend can desynchronize HAProxy's FCGI framing parser, causing HAProxy to misroute requests and deliver responses intended for one client to a different client.
• The integrity of responses transiting HAProxy is compromised at the downstream scope (SI:H), allowing injection or modification of HTTP responses served to end users.
• The vulnerability carries a low confidentiality impact at the downstream scope (SC:L), meaning partial exposure of response content across connection boundaries is possible.
• Memory safety issues arising from the integer overflow in the drl field may produce undefined behavior in the HAProxy process, with the potential for further memory corruption under specific heap layouts.