{"id":"CVE-2026-33555","revision":"49828efd7ef544a39ba15bfc802371d0","records":[{"revision":"49828efd7ef544a39ba15bfc802371d0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-33555","aliases":[],"title":"An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desync…","description":"An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.","state":0,"publishedAt":"2026-04-13T00:00:00+00:00","modifiedAt":"2026-10-18T20:07:07.236+00:00","affected":[{"ecosystem":"Vendor product","name":"HAProxy","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"HAProxy\",\n                    \"vendor\": \"HAProxy\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"3.3.6\",\n                            \"status\": \"affected\",\n                            \"version\": \"2.6\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","score":4,"severity":"MEDIUM"}],"references":["https://www.haproxy.org/","https://www.haproxy.com/documentation/haproxy-aloha/changelog/","https://github.com/haproxy/haproxy/commit/05a295441c621089ffa4318daf0dbca2dd756a84","https://www.mail-archive.com/haproxy@formilux.org/msg46752.html","https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-33555","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-33555","identifiers":["CVE-2026-33555"]},"retained":false,"historicalAffected":[]}],"coverage":[]}