CVE-2026-55203: HAProxy Integer Overflow in FastCGI Parser (CVSS 7.5)

Technical summary

The vulnerability resides in the fcgi_conn structure's drl (data remaining length) field. When processing FCGI record headers, if contentLength equals 65535 and paddingLength is 1 or greater, integer arithmetic causes drl to overflow and wrap to 0. This causes the parser to incorrectly consume or skip FCGI frame boundaries, leading to desynchronization between the client-facing and backend-facing protocol state machines. An attacker-controlled FastCGI backend can exploit this to violate FCGI framing semantics, potentially causing request smuggling, routing confusion, or heap corruption if downstream code assumes certain buffer properties.

Business impact

Organizations relying on HAProxy as a reverse proxy or load balancer for FastCGI applications face potential service disruption and data integrity risks. If an attacker compromises a backend FastCGI service or can inject malicious responses, they can trigger response smuggling (delivering unintended responses to other clients), route requests to wrong destinations, or crash HAProxy workers. In defense-in-depth scenarios where the FastCGI backend is already untrusted or exposed to supply-chain risk, this vulnerability provides a direct attack vector into the proxy layer itself.

Affected systems

HAProxy versions 3.4.0 and earlier are vulnerable. The fix is available in commit 5985276. Organizations using HAProxy to proxy or load-balance FastCGI-based applications (common in PHP, Python, and other CGI environments) should prioritize verification and patching. Systems where HAProxy frontends untrusted or external FastCGI backends are at highest risk.

Exploitability

Exploitation requires the attacker to either control a FastCGI backend service or compromise one that HAProxy routes to. Public exploit code is not widely available, and the vulnerability requires precise crafting of FCGI frames to trigger. The CVSS vector reflects network-adjacent attack surface (AV:N), high complexity (AC:H), and no authentication required. Practical exploitation depends on backend compromise, which raises the bar but is plausible in compromised supply chains or misconfigured environments where backends are exposed.

Remediation

Upgrade HAProxy to a patched version containing commit 5985276 or later. Verify the specific patch version number against the official HAProxy release notes or vendor advisory. In the interim, restrict network access to FastCGI backend services—ensure only trusted HAProxy instances can connect to backends, and monitor FastCGI traffic for malformed frames. If HAProxy is exposed to untrusted backends, isolation and network segmentation are critical mitigating controls.

Patch guidance

Check the HAProxy release notes or security advisories for the patched version corresponding to commit 5985276. Update HAProxy across all load-balancing and reverse-proxy infrastructure. Test the upgrade in a staging environment first, particularly if you run custom HAProxy modules or have complex FastCGI routing logic. Verify that your FastCGI backend connections remain functional post-patch.

Detection guidance

Monitor HAProxy error logs for FCGI protocol errors, unexpected connection resets, or request routing anomalies. Look for signs of desynchronized FCGI frames (e.g., misaligned record boundaries, content-length mismatches). Network-based detection is difficult without deep packet inspection of FCGI traffic. Application-level detection should focus on unexpected request routing or response origin mismatches. If you have WAF or intrusion detection in front of HAProxy, look for backoff signatures or patterns of malformed FCGI headers from backend sources.

Why prioritize this

This vulnerability earns HIGH severity because it can enable request smuggling and response hijacking in a core infrastructure component (the proxy layer), affecting all downstream applications. Although it requires backend compromise to exploit, that scenario is increasingly plausible given supply-chain and container security risks. Organizations running HAProxy with FastCGI should prioritize patching within their standard patch cycle, particularly if backends are sourced from third parties or run untrusted code.

Risk score, explained

CVSS 7.5 reflects a network-reachable attack vector with high impact on integrity (response smuggling, routing manipulation) and low impact on confidentiality. The attack complexity is high because it requires backend compromise and precise FCGI framing. Scope is changed, meaning the vulnerability affects resources beyond the vulnerable component itself (other clients' requests and responses). The score does not account for breach likelihood if FastCGI backends are already secured; in high-trust environments, effective risk is lower, but in supply-chain or multi-tenant scenarios, it justifies timely patching.

Frequently asked questions