CVE detail
CVE-2026-33555
An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 22.0 · diversity 20.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
8 source links · newest first
Linked URL: https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html | Posted by r3verii | 2 points | 0 comments
communitynews.ycombinator.comApr 26, 2026, 8:26 AMLinked URL: https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html | Posted by r3verii | 2 points | 0 comments
communitynews.ycombinator.comApr 18, 2026, 7:53 AM- CVE-2026-33555Microsoft MSRC
Information published.
vendormsrc.microsoft.comApr 15, 2026, 8:01 AM - https://www.mail-archive.com/[email protected]/msg46752.htmlwww.mail-archive.com
No excerpt available.
Third Party Advisorywww.mail-archive.comApr 13, 2026, 5:16 PM - https://www.haproxy.orgwww.haproxy.org
No excerpt available.
Productwww.haproxy.orgApr 13, 2026, 5:16 PM No excerpt available.
Vendor Advisorywww.haproxy.comApr 13, 2026, 5:16 PMNo excerpt available.
Exploitr3verii.github.ioApr 13, 2026, 5:16 PMNo excerpt available.
Exploitgithub.comApr 13, 2026, 5:16 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-62424CVSS 5.5 · Medium
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfs…
- CVE-2026-62423CVSS 5.5 · Medium
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfs…
- CVE-2026-26081CVSS 4.8 · Medium
HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.
- CVE-2026-54466CVSS 9.2 · Critical
websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that all…
- CVE-2026-48487CVSS 5.3 · Medium
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string and _read_string in src/zeroconf/_protocol/incoming.py advan…
- CVE-2026-60060CVSS 5.1 · Medium
Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish…