https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-04T20:54:05.276402+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-55203 CVE-2026-55203 — HAProxy - Integer Overflow in FCGI Demux Record Length Field 2026-10-04T20:54:05.325768+00:00

Affected: haproxy

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

 https://vulnerability.circl.lu/vuln/usn-8459-1 USN-8459-1 — haproxy vulnerabilities 2026-10-04T20:54:05.325886+00:00

Affected: Ubuntu:22.04:LTS: haproxy, Ubuntu:24.04:LTS: haproxy, Ubuntu:25.10: haproxy, Ubuntu:26.04:LTS: haproxy

It was discovered that HAProxy incorrectly handled the FCGI demultiplexer record length field. A remote attacker could possibly use this issue to cause incorrect request routing, response smuggling, or other memory safety issues. (CVE-2026-55203)

It was discovered that HAProxy failed to validate the return value of the HPACK dynamic table defragmentation function when memory was exhausted. A remote attacker could possibly use this issue to cause HAProxy to crash, resulting in a denial of service. (CVE-2026-55204)