CVE-2026-33555: 
HAProxy vulnerability analysis and mitigation

CVE-2026-33555 is an HTTP/3 request smuggling vulnerability in HAProxy caused by improper handling of length parameter inconsistency (CWE-130). The HTTP/3 parser fails to validate that the received body length matches a previously announced Content-Length header when a QUIC stream is closed via a STREAM frame with an empty payload and FIN bit set. This affects HAProxy versions 2.6 through 3.3.5; the fix is present in version 3.3.6 and later. It was disclosed on April 13, 2026, and carries a CVSS v3.1 base score of 4.0 (Medium) (Github Advisory, HAProxy Commit).

The root cause lies in HAProxy's HTTP/3 (h3.c) parsing logic, which introduced a shortcut path — qcs_http_handle_standalone_fin() — to handle QUIC STREAM frames that carry no data but have the FIN bit set. This shortcut bypasses the h3_check_body_size() validation that would normally confirm the received body length matches any declared Content-Length header. As a result, an attacker can send a specially crafted HTTP/3 request over QUIC where the body is terminated early (via a standalone FIN frame) without fulfilling the announced content-length, causing HAProxy and the backend server to disagree on where one request ends and the next begins — a classic HTTP request smuggling desynchronization. The vulnerability was reported by Martino Spagnuolo via the HAProxy security mailing list (HAProxy Commit, Github Advisory). A public PoC (Python-based, Docker-composed) is available at r3verii/CVE-2026-33555, and a detailed write-up exists at r3verii's blog.

Successful exploitation allows an unauthenticated remote attacker to perform HTTP request smuggling attacks against backend servers sitting behind HAProxy. By desynchronizing the proxy's and backend's view of HTTP request boundaries, an attacker could inject malicious requests, bypass security controls (such as WAF rules or authentication checks enforced at the proxy layer), poison shared connection queues, or hijack other users' requests. The integrity impact is low and confidentiality impact is none per the CVSS scoring, but in practice request smuggling can be chained with other techniques to escalate impact, including session hijacking or unauthorized access to protected resources (Github Advisory, HAProxy Commit).

1. Reconnaissance: Identify HAProxy instances (versions 2.6–3.3.5) exposed to the internet with HTTP/3 (QUIC) enabled, using tools like Shodan or Censys filtering for QUIC/UDP port 443.
2. Set up QUIC client: Use a QUIC-capable HTTP/3 client library (e.g., aioquic in Python) to establish a QUIC connection to the target HAProxy instance.
3. Craft malicious HTTP/3 request: Send an HTTP/3 POST request with a Content-Length header declaring a body size (e.g., Content-Length: 100) but include only partial or no body data in the STREAM frames.
4. Send standalone FIN frame: Close the QUIC stream by sending a STREAM frame with the FIN bit set and an empty payload, without having transmitted the full body declared in Content-Length. This triggers the vulnerable code path that skips h3_check_body_size().
5. Observe desynchronization: The backend server receives a request with an incomplete body but interprets the remaining bytes as the start of a new request, causing request boundary confusion. This can be confirmed by observing unexpected HTTP 400 responses or response body leakage from other requests.
6. Exploit smuggled request: Craft the partial body content to contain a complete secondary HTTP/1.x request that will be interpreted by the backend as a new, independent request — potentially bypassing proxy-level security controls or poisoning shared backend connections (HAProxy Commit, r3verii PoC).

• Network: Unusual QUIC/UDP traffic to port 443 with HTTP/3 STREAM frames carrying FIN bits and empty payloads following requests with non-zero Content-Length headers; unexpected HTTP 400 responses from backend servers in response to seemingly valid requests.
• Logs: HAProxy logs showing stream resets with H3_MESSAGE_ERROR codes (post-patch behavior) or, on unpatched systems, backend servers logging malformed or unexpected requests with mismatched content lengths; repeated 400 Bad Request responses from backend for requests originating from HAProxy.
• Process/Behavior: Backend application logs showing requests with unexpected or truncated bodies, or requests appearing to begin mid-stream; anomalous session behavior such as one user receiving another user's response data.

The primary remediation is to upgrade HAProxy to version 3.3.6 or later, which includes the fix adding a call to h3_check_body_size() before processing standalone FIN frames in the HTTP/3 parser (HAProxy Commit). The fix has been backported to the 2.6 branch as well. For organizations unable to patch immediately, consider disabling HTTP/3/QUIC support in HAProxy configuration if it is not operationally required, or restricting QUIC access to trusted source IP ranges. Linux distribution packages for SUSE, openSUSE, Ubuntu, Debian, and Mageia have been updated with the fix (openSUSE Advisory).

The vulnerability generated moderate community discussion on Reddit's r/netsec, r/cybersecurity, and r/AskNetsec shortly after disclosure, with threads focusing on the HTTP/3 desync mechanism and its cross-protocol smuggling implications (Reddit r/netsec). PentesterLab highlighted it in their "Research Worth Reading" weekly digest for Week 18 of 2026 (PentesterLab Blog). The researcher who discovered the vulnerability (Martino Spagnuolo) published a detailed technical write-up, and the PoC author (r3verii) provided a Docker-based demonstration environment, both of which were widely shared in security communities.