CVE-2026-33555

4.0

MEDIUM CVSS 3.1

HAProxy HTTP/3 Request Smuggling Vulnerability

Overview

Description

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

Details

INFO

Published Date :

April 13, 2026, 5:16 p.m.

Last Modified :

April 22, 2026, 7:17 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

Impact

Affected Products

The following products are affected by CVE-2026-33555 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Haproxy	haproxy

: Total Affected Vendor : 1 | Products : 1

Scoring

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	MEDIUM				[email protected]

Solution

Update HAProxy to a fixed version to resolve HTTP/3 body length desynchronization and request smuggling.

Update HAProxy to version 3.3.6 or later.
Apply relevant security patches to the backend server.
Configure HTTP/3 parser rigorously.

Public PoC/Exploit Available at Github

CVE-2026-33555 has a 3 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-33555.

URL	Resource
https://github.com/haproxy/haproxy/commit/05a295441c621089ffa4318daf0dbca2dd756a84
https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html
https://www.haproxy.com/documentation/haproxy-aloha/changelog/
https://www.haproxy.org
https://www.mail-archive.com/[email protected]/msg46752.html
https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-33555 is associated with the following CWEs:

CWE-130: Improper Handling of Length Parameter Inconsistency

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-33555 weaknesses.

CAPEC-47: Buffer Overflow via Parameter Expansion Buffer Overflow via Parameter Expansion

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

r3verii/CVE-2026-33555

One zero-byte QUIC packet is enough to desynchronize HAProxy's backend connection pool and smuggle HTTP requests across unrelated users — even users on a completely different frontend protocol.

Dockerfile Python HTML

Updated: 3 weeks, 1 day ago

0 stars 0 fork 0 watcher

Born at : April 16, 2026, 7:53 p.m. This repo has been linked 1 different CVEs too.

holmanholdings/lionguard

Cathedral-Grade Security for AI Agents. Attack vectors updated daily. Local-first, zero API cost. MIT licensed.

Python

Updated: 2 weeks, 3 days ago

5 stars 0 fork 0 watcher

Born at : March 13, 2026, 5:10 p.m. This repo has been linked 57 different CVEs too.

nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 2 weeks, 1 day ago

7667 stars 1247 fork 1247 watcher

Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 749 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-33555 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-33555 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

Apr. 22, 2026

Action	Type	Old Value	New Value
Added	Reference		https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html

CVE Modified by [email protected]