BIT-haproxy-2026-33555: Medium severity HAProxy HAProxy vulnerability

Q: Which deployments are affected?

The issue affects HAProxy versions from 2.6 through versions before 3.3.6 when handling HTTP/3 traffic. Deployments that do not use HTTP/3 are not identified as affected by the provided information.

Q: What must an attacker do to exploit this?

An attacker must send HTTP/3 traffic with a previously announced Content-Length and close the stream using a frame with an empty payload. Exploitation relies on HAProxy accepting a body whose received length does not match the announced Content-Length, creating a parsing mismatch with the backend server.

Q: What is the likely impact?

The mismatch can desynchronize HAProxy and the backend server's interpretation of requests. This could enable request smuggling and may affect the integrity of backend requests.

Q: What version resolves the issue?

HAProxy 3.3.6 is not included in the affected versions. Versions before 3.3.6 are affected according to the provided information.

Published Apr 13, 2026

Updated

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

Affected Software

1 affected component

HAProxy HAProxy>=2.6<3.3.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade HAProxy to a version that resolves this vulnerability.
Fixed in 3.3.6

Event History

Apr 13, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

The issue affects HAProxy versions from 2.6 through versions before 3.3.6 when handling HTTP/3 traffic. Deployments that do not use HTTP/3 are not identified as affected by the provided information.

What must an attacker do to exploit this?

An attacker must send HTTP/3 traffic with a previously announced Content-Length and close the stream using a frame with an empty payload. Exploitation relies on HAProxy accepting a body whose received length does not match the announced Content-Length, creating a parsing mismatch with the backend server.

What is the likely impact?

The mismatch can desynchronize HAProxy and the backend server's interpretation of requests. This could enable request smuggling and may affect the integrity of backend requests.

What version resolves the issue?

HAProxy 3.3.6 is not included in the affected versions. Versions before 3.3.6 are affected according to the provided information.

BIT-haproxy-2026-33555: Medium severity HAProxy HAProxy vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What must an attacker do to exploit this?

What is the likely impact?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What must an attacker do to exploit this?

What is the likely impact?

What version resolves the issue?