REDHAT-BUG-2490522: Integer Overflow

Q: Who is realistically exposed to this vulnerability?

Systems are exposed when HAProxy processes FastCGI records from a backend that can send malicious or compromised FastCGI responses. The issue can desynchronize HAProxy's FastCGI framing parser, with potential effects including request routing errors, response smuggling, or memory safety issues.

Q: What conditions are required to exploit the flaw?

An attacker needs the ability to control or influence a FastCGI backend's records. Exploitation relies on a record with contentLength set to 65535 and paddingLength of at least 1, which causes the affected drl field to wrap to zero.

Q: What should be done if an affected deployment is identified?

Update to a HAProxy version that includes commit 5985276. The provided information does not identify an alternative mitigation or configuration workaround.

Published Jun 18, 2026

Updated

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgiconn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

Affected Software

1 affected component

HAProxy HAProxy<=3.4.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade haproxy to a version that resolves this vulnerability.
Patch 5985276

Event History

Jun 18, 2026

Data Sourced

via Red Hat·05:02 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is realistically exposed to this vulnerability?

Systems are exposed when HAProxy processes FastCGI records from a backend that can send malicious or compromised FastCGI responses. The issue can desynchronize HAProxy's FastCGI framing parser, with potential effects including request routing errors, response smuggling, or memory safety issues.

What conditions are required to exploit the flaw?

An attacker needs the ability to control or influence a FastCGI backend's records. Exploitation relies on a record with contentLength set to 65535 and paddingLength of at least 1, which causes the affected drl field to wrap to zero.

What should be done if an affected deployment is identified?

Update to a HAProxy version that includes commit 5985276. The provided information does not identify an alternative mitigation or configuration workaround.

REDHAT-BUG-2490522: Integer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this vulnerability?

What conditions are required to exploit the flaw?

What should be done if an affected deployment is identified?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this vulnerability?

What conditions are required to exploit the flaw?

What should be done if an affected deployment is identified?