CVE-2026-55203

A flaw was found in HAProxy. A malicious FastCGI (Fast Common Gateway Interface) backend can exploit an integer overflow vulnerability in the fcgi_conn structure's drl field. This occurs when specific contentLength and paddingLength values cause the drl field to wrap to zero, leading to incorrect record consumption. This desynchronizes the FCGI framing parser, potentially resulting in response smuggling, request routing errors, or memory safety issues.

Conditions for Exploitation: Successful exploitation requires a specific configuration where HAProxy is actively utilizing a FastCGI backend. Crucially, an attacker must already have control over this backend server to supply the maliciously crafted responses.

This requirement significantly restricts the attack vector, as it relies on an unlikely configuration or an already compromised backend, rather than a typical remote attack initiated by a client against a default frontend server.

Impact Limitations: Although the vulnerability can cause the FastCGI framing parser to desynchronize—potentially leading to response smuggling, request routing errors, or memory safety issues—the threat is contained entirely to environments that process traffic from untrusted or compromised backend servers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict access to HAProxy instances that utilize FastCGI to trusted FastCGI backends only. If FastCGI is not required, consider disabling its use in HAProxy configurations to eliminate the attack vector. Ensure that all FastCGI backends are secured and not susceptible to compromise. If the HAProxy service is reloaded or restarted after configuration changes, ensure proper validation of the new configuration.