CVE-2026-55203 is a high severity integer overflow (CVSS 7.5) in HAProxy through 3.4.0. In the FastCGI multiplexer, a record length field wraps to zero in one padding case, so a malicious FastCGI backend can desynchronize the parser. The fix is commit 5985276. Check HAProxy release notes for the version that carries it.
What's affected
- HAProxy through 3.4.0, per the record.
- Fixed in commit 5985276 on the HAProxy source tree. The record does not name a release, so check the HAProxy changelog or your distribution for the build that includes it.
- Setups that use HAProxy as a FastCGI client toward a backend such as PHP-FPM. The flaw needs a malicious FastCGI backend.
How to check if you're exposed
Check the version and look for FastCGI use.
haproxy -v
grep -n "use-fcgi-app\|fcgi-app" /etc/haproxy/haproxy.cfg
If the configuration has no FastCGI backends, you do not run the affected code path. If it does, note who controls those backends. The risk is largest when the backend is shared or less trusted than the proxy.
What to do now
- Find the HAProxy version that includes commit 5985276, in the project changelog or your vendor package notes.
- Upgrade HAProxy on every host that uses FastCGI backends.
- Treat FastCGI backends as part of your trust boundary, and keep them under your control.
- Keep a record of which hosts use FastCGI so the next HAProxy advisory is quick to triage.
Why it matters
The class is CWE-190, integer overflow or wraparound. The record says the field holding the remaining record length is too small for the largest content length. With a content length of 65535 and padding of one or more, it wraps to zero, and the parser then treats the rest of the bytes as a new record header.
That kind of framing confusion can cause routing errors, response smuggling or memory safety issues, per the record. The score is moderate because it needs a malicious backend, and the vector lists high complexity. The record does not mark the CVE as exploited in the wild.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Quick check
Does this affect plain HTTP proxying?
The record describes the FastCGI multiplexer. Configurations without FastCGI backends do not use that code.
Sources
- https://github.com/haproxy/haproxy/commit/5985276735777634d8c85f1d73bb7764aab0d6dd
- https://www.vulncheck.com/advisories/haproxy-integer-overflow-in-fcgi-demux-record-length-field
Last reviewed: 19 October 2026.
