CVE-2026-33555
Haproxy 2.6.0 – 3.3.6
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:NSummary
CVE-2026-33555 is a medium-severity Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability in Haproxy Haproxy. Its CVSS base score is 4.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21997
Vulnerability Data
An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization…
more
issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
HTTP/3 request smuggling vulnerability in public-facing HAProxy proxy directly enables exploitation of a public-facing application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation of length parameters (content-length vs. actual body) in HTTP/3 streams to block the desynchronization exploited by this CVE.
Enforces proper information flow and protocol semantics at the proxy boundary, preventing request smuggling that results from the length mismatch.
Requires timely application of the vendor patch (HAProxy 3.3.6+) that adds the missing length-consistency check in the HTTP/3 parser.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce length validation and input sanitization during coding and review.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect length-inconsistency vulnerabilities before deployment.
Secure development lifecycle mandates input validation and length checks that directly address inconsistent length fields.
Application security requirements include explicit rules for handling message lengths and data structures.
Secure architecture principles require robust parsing and bounds checking to prevent length-related flaws.
Secure coding standards directly prohibit improper length handling and enforce defensive parsing practices.