CVE-2026-55203: 
HAProxy vulnerability analysis and mitigation

CVE-2026-55203 is an integer overflow vulnerability in HAProxy's FastCGI (FCGI) multiplexer that allows malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues. It affects HAProxy through version 3.4.0 (including the Aloha product line) and was disclosed on June 18, 2026, with a fix available in commit 5985276. The vulnerability was reported by Tristan (@TristanInSec) and assigned a CVSS v3.1 score of 9.1 (Critical) and a CVSS v4.0 score of 9.0 (Critical) (GitHub Advisory, HAProxy Commit).

The root cause is a CWE-190 (Integer Overflow or Wraparound) in the fcgi_conn structure's drl (demux record length) field, which was typed as uint16_t. In the ignore_record path, the expression fconn->drl += fconn->drp overflows to 0 when contentLength is 65535 and paddingLength is 1 or more, since the sum exceeds the maximum value of a 16-bit unsigned integer. When drl wraps to 0, the state machine incorrectly considers the FCGI record complete without consuming any buffer data, causing the remaining buffer contents to be parsed as new FCGI record headers. The fix widens drl from uint16_t to uint32_t, preventing the overflow since drp (a uint8_t) can be at most 255 (HAProxy Commit, GitHub Advisory). Exploitation requires control of a malicious FastCGI backend that communicates with HAProxy, meaning the attacker must be positioned as or have compromised a backend server.

Successful exploitation allows an attacker controlling a malicious FastCGI backend to desynchronize HAProxy's FCGI framing parser, leading to request routing errors, response smuggling (injecting forged responses into the FCGI stream), or memory safety issues. The integrity impact is high — both on the vulnerable HAProxy system and on subsequent systems — as smuggled responses could be delivered to unintended clients, potentially exposing sensitive data or enabling further attacks. Availability may also be affected through memory corruption, while direct confidentiality impact on the HAProxy process itself is assessed as none (GitHub Advisory, HAProxy Commit).

1. Gain control of a FastCGI backend: The attacker must control or compromise a FastCGI backend server (e.g., PHP-FPM, a custom FCGI application) that is configured as a backend in the target HAProxy instance.
2. Craft a malicious FCGI response: Construct an FCGI response record with contentLength set to 65535 (0xFFFF) and paddingLength set to 1 or more, targeting the ignore_record processing path in HAProxy's FCGI multiplexer.
3. Trigger the integer overflow: When HAProxy processes this record, the expression fconn->drl += fconn->drp (i.e., 65535 + paddingLength) overflows the uint16_t field, wrapping drl to 0.
4. Desynchronize the parser: With drl at 0, HAProxy's state machine considers the record complete without consuming buffer data; subsequent buffer contents are misinterpreted as new FCGI record headers.
5. Achieve response smuggling or memory corruption: By carefully crafting the remaining buffer content, the attacker can inject forged FCGI records, cause request routing errors, deliver smuggled responses to unintended clients, or trigger memory safety issues in HAProxy (HAProxy Commit, GitHub Advisory).

• Network: Unexpected or malformed FCGI response records from backend servers with contentLength of 65535 (0xFFFF) and non-zero paddingLength; anomalous HTTP responses delivered to clients that do not match expected backend output.
• Logs: HAProxy logs showing request routing errors, unexpected backend response parsing failures, or mismatched request/response pairings; unusual FCGI framing errors in HAProxy debug logs.
• Process: HAProxy process exhibiting unexpected crashes, memory faults, or abnormal resource consumption potentially indicative of memory safety issues triggered by the overflow.

The fix is available in HAProxy commit 5985276, which widens the drl field from uint16_t to uint32_t in src/mux_fcgi.c. Users should update HAProxy to a version that includes this commit (post-3.4.0). As interim workarounds, restrict FastCGI backend connections to only trusted, verified servers, and implement network segmentation to limit which systems can communicate with HAProxy as FastCGI backends. Distribution-specific patches have been issued for Ubuntu (USN-8459-1) and SUSE (SUSE-SU-2026:2652-1) (HAProxy Commit, GitHub Advisory).

The vulnerability received coverage from security news outlets including SecurityOnline.info and Linux security advisory aggregators. Community discussion was noted on Mastodon/infosec.exchange, with security researchers such as @cR0w and @vuldb sharing the advisory. Distribution vendors including Ubuntu and SUSE promptly issued security updates, reflecting the critical severity rating (SUSE Advisory).