HAProxy CVE-2026-55203

Exploitation requires HAProxy to be deployed with at least one FastCGI backend (use_backend / server proto fcgi) and for the attacker to control or compromise that FastCGI application server so it can emit a response record with contentLength == 65535 and paddingLength >= 1; client-side authentication is not required (PR:N) but the AT:P attack requirement - a malicious FCGI backend - is the gating condition. Exploitation is limited by: deployments that only proxy HTTP/HTTPS (no FCGI mux loaded) are not reachable, single-tenant FCGI setups gain little from response smuggling, and the desync primitive depends on HAProxy multiplexing more than one logical stream over the affected FCGI connection.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N) yields 9.0 and emphasizes high integrity impact on both the vulnerable system and a subsequent system, which fits a smuggling/desync primitive that pollutes traffic across requests. Crucially, AT:P (attack requirement: present) reflects that exploitation requires a malicious or attacker-controlled FastCGI backend - HAProxy must be configured to mux FCGI to that backend, which is not its default mode and is uncommon compared to HTTP backends. This is not a wormable internet-facing RCE: the threat model is a compromised or rogue FCGI application server abusing the framing bug to smuggle responses to other tenants/requests routed through the same HAProxy. No EPSS, KEV, or POC signals are provided, and no public exploit identified at time of analysis. Real-world priority is high for multi-tenant or shared-backend deployments using FCGI, lower for environments that only proxy HTTP/HTTPS.

An attacker who has compromised, or operates, a FastCGI application server behind a shared HAProxy instance crafts FCGI records with contentLength 65535 and paddingLength >= 1 so that HAProxy's drl wraps to zero mid-record. HAProxy then realigns onto attacker-chosen bytes inside the padding/body, treating them as a new FCGI record header and routing the smuggled response to the next victim request that happens to share the connection or session. No public exploit identified at time of analysis, but the conditions are mechanically reproducible from the description and the one-line commit diff.