An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desync…

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-33555 · Microsoft / collected KEV context

cve-program · CVE-2026-33555

• https://www.haproxy.org/
• https://www.haproxy.com/documentation/haproxy-aloha/changelog/
• https://github.com/haproxy/haproxy/commit/05a295441c621089ffa4318daf0dbca2dd756a84
• https://www.mail-archive.com/[email protected]/msg46752.html
• https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html

No related operational record is retained in the current change model.