CVE-2026-33555
Medium
Description
An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.
SeverityMedium
CVSS4.0
Exploit probability—
ProductHaproxy
PublishedApr 13, 2026
First seenApr 13, 2026
Weakness typeCWE-130CWE-130
How to fix
Update
- haproxy haproxy3.3.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| haproxy haproxy | 2.6.0 ≤ v < 3.3.6 | 3.3.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.