Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-33555

CVE-2026-33555MEDIUM

HAProxy HAProxy — An issue was discovered in HAProxy before 3.3.6.

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  N  L  N    5.8   .0058   46.4     —

AFFECTED
  Product  Versions  Fixed
  HAProxy  2.6 –     —

TIMELINE
  Mar 22  Reserved by mitre
  Apr 13  Published (CNA: mitre)
  Oct 18  EXPLOIT PUBLISHED — CVE-2026-33555 (HAProxy). Public exploit reference added.
  Oct 18  RESCORED — CVE-2026-33555 (HAProxy). CVSS 4 → 5.8 (NVD).

CWE-130 · CNA: mitre · CVSS v3.1 · 6 references · NVD status: Modified

Description

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
March 22, 2026	Reserved	Reserved by mitre
April 13, 2026	Published	Published (CNA: mitre)
October 18, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-33555 (HAProxy). Public exploit reference added.
October 18, 2026	RESCORED	RESCORED — CVE-2026-33555 (HAProxy). CVSS 4 → 5.8 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
HAProxy	HAProxy	—	2.6	—

Weaknesses

CWE-130

References (6)

https://github.com/haproxy/haproxy/commit/05a295441c621089ffa4318daf0dbca2dd756a84 [Patch]
https://lists.debian.org/debian-lts-announce/2026/10/msg00036.html
https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html [Exploit, Third Party Advisory]
https://www.haproxy.com/documentation/haproxy-aloha/changelog/ [Release Notes]
https://www.haproxy.org [Product]
https://www.mail-archive.com/haproxy@formilux.org/msg46752.html [Release Notes]

Authoritative record: CVE-2026-33555 at cve.org

Vendors: haproxy

Weaknesses: CWE-130

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-33555 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.