CVE-2026-33555

Executive Summary

CVE-2026-33555 is a request smuggling vulnerability in HAProxy's HTTP/3 parser, affecting all versions from 2.6.0 up to but not including 3.3.6. The flaw stems from the parser's failure to validate that received body length matches the previously announced Content-Length header when a stream is terminated by a frame with an empty payload. An attacker exploiting this flaw can desynchronize the frontend connection state from the backend server's view of request boundaries, potentially enabling HTTP request smuggling — a technique that allows attackers to bypass security controls, poison caches, or hijack other users' requests. The vulnerability carries a CVSS score of 4.0 (Medium) with a scope-changed vector, reflecting its network reachability but requirement for specific HTTP/3 traffic conditions.

Technical Analysis

The vulnerability resides in HAProxy's HTTP/3 protocol handling code (the h3 module), specifically in the stream state machine responsible for parsing request/response bodies. In HTTP/3, data integrity and length semantics are communicated through two mechanisms: the Content-Length header (a hop-by-hop field within the application layer) and HTTP/3 frame headers (which carry their own Length field at the QUIC/HTTP3 layer).

The core flaw is an inconsistency check omission. When HTTP/3 frames are processed, HAProxy tracks the body length announced via the Content-Length header. However, when a stream is closed via a DATA frame with an empty payload (i.e., a zero-length frame signaling stream termination), the parser fails to compare the total accumulated body bytes against the previously advertised Content-Length value.

This creates a length desynchronization between:

• What HAProxy believes is the complete request body (based on frame boundaries), and
• What the backend server reconstructs as the request body (based on Content-Length header).

From a code perspective, the HTTP/3 frame decoder likely fails to invoke a length-comparison check when it encounters frame_length == 0 upon stream finalization. In HTTP/2 and HTTP/1.1, HAProxy's h2 and h1 modules perform explicit checks assuring that the sum of DATA frame lengths equals the announced Content-Length. The h3 module introduced in version 2.6 missed this validation path for the empty-final-frame case, making it a classic CWE-130 (Improper Handling of Length Parameter Inconsistency).

The attack surface is the frontend HTTP/3 listener. An attacker must be able to send raw HTTP/3 requests to the HAProxy instance — typically through TCP/UDP port 443 where QUIC is served. The desynchronization does not affect the TLS or QUIC layer itself; it is purely an application-layer (HTTP/3) parser flaw.

From an exploitation perspective, the attacker crafts a request with a Content-Length: N header, but sends only N-k bytes of body within DATA frames, followed by an empty DATA frame that terminates the stream. HAProxy accepts the truncated body and forwards it to the backend, which is still waiting for k more bytes. Depending on how HAProxy pipelines or multiplexes subsequent requests (HTTP/3 supports concurrent streams), the backend may interpret the beginning of the attacker's next request as part of the previous request's body — or conversely, interpret the next request from the backend perspective as a new request when HAProxy considers it part of the same stream.

Exploitation Scenarios

The following attack chain details how an adversary would exploit CVE-2026-33555 against a target running HAProxy 2.6 through 3.3.5 with HTTP/3 enabled:

1) Reconnaissance & Target Identification

The attacker first identifies internet-facing HAProxy instances with HTTP/3 (QUIC) enabled. Using Shodan or Censys, the adversary searches for products matching HAProxy or for ASN/services that expose UDP/443. The attacker then probes the endpoint with a simple HTTP/3 GET / request using tools like nghttp3, curl --http3, or h3-test. If the server responds with alt-svc: h3=":443" in the HTTP/2 response header, HTTP/3 is confirmed as active. Version identification can be done via the Server: HAProxy X.X.X response header (when not stripped by configuration) or by banner-grabbing through error page responses.

2) Crafting the Smuggling Payload

The attacker must instrument an HTTP/3 client library that permits fine-grained control over frame sequences. Libraries such as quiche (Cloudflare), nghttp3, or aioquic provide the necessary frame-level API. The attacker must disable automatic frame coalescing and manually control:

• The HEADERS frame containing a request line like POST /transfer HTTP/1.1 with Host: victim.com, Content-Length: 5, and a body of A.
• A subsequent DATA frame with payload length 1 (containing the byte A).
• A final empty DATA frame (payload length 0) that closes the stream — this triggers the parsing flaw.

To complete the smuggling, the attacker appends a second request directly in the same connection, e.g., POST /admin HTTP/1.1 with Content-Length: 4 and body B.

3) Exploit Execution

The attacker opens a single HTTP/3 connection to HAProxy and transmits the frames in the order:

HEADERS  (POST /transfer, CL: 5)
DATA     (len=1, payload="A")
DATA     (len=0)     <- triggers the validation bypass
HEADERS  (POST /admin, CL: 4)
DATA     (len=1, payload="B")

HAProxy's H3 parser processes this, sees CL: 5 on the first request but only accumulates 1 body byte (from the first DATA). Because the empty DATA frame is treated as a valid end-of-stream marker without performing the length check, HAProxy marks request 1 as complete and forwards it to the backend, appending the second HEADERS stream as a new, pipelined request.

The backend (e.g., a typical nginx or Apache server implementing HTTP/1.1 over the upstream connection) sees:

• Request 1: POST /transfer with Content-Length: 5 and body A — but expects 4 more bytes. The backend will not consider the request complete.
• The backend has buffered the bytes of the second HEADERS frame as pending body. It waits.

HAProxy, however, considers the backend request complete and sends Content-Length of the backend response, while the backend believes the request is still body-draining. When the backend receives the next request bytes (the second POST), it interprets the first 4 bytes (POST) as the remaining body of request 1, leaving /admin HTTP/1.1... to be interpreted as the start of a new request. This causes a desync where HAProxy's view of the frontend connection differs from the backend's — the classic request-smuggling primitive.

4) Post-Exploitation Impact

The attacker can now:

• Smuggle requests past WAF/ACL rules: HAProxy enforces access controls before forwarding, but the smuggled second request (/admin) arrives at the backend without being properly parsed at the frontend layer, potentially bypassing path-based allowlists.
• Poison the backend cache or a shared frontend cache: By smuggling a malicious request that the backend responds to, the attacker ensures that response gets cached and served to other clients.
• Hijack legitimate user requests: If the backend reuses the same connection or keep-alive sessions, the attacker's crafted request can be chained ahead of (or behind) a victim's request, potentially capturing or redirecting session data.

Impact Assessment

Business Impact: Request smuggling vulnerabilities have historically been rated as high-severity despite moderate CVSS scores due to their cascading effects. A successful exploit of this CVE allows an attacker to:

• Bypass HAProxy's Layer 7 access controls and security policies.
• Poison CDN or reverse-proxy caches, serving malicious content or scripted payloads to unsuspecting users (stored XSS at scale).
• Steal sensitive user data (cookies, CSRF tokens) by redirecting or splicing victim requests.
• Conduct session fixation or session hijacking.

Affected Systems: All HAProxy deployments running 2.6.0 through 3.3.5 with HTTP/3 listeners enabled. Default configurations in HAProxy 2.6+ for frontends serving on port 443 with h3 binding or proto h3 in the bind line are susceptible. Environments without QUIC/HTTP/3 listeners (HTTP/1.1 or HTTP/2 only) are not affected.

Blast Radius: Medium. The scope-changed (S:C) component of the CVSS vector indicates the vulnerability can impact resources beyond the HAProxy process's security scope — specifically the backend servers and their applications. However, the high attack complexity (AC:H) tempers the score: exploitation requires precise control over HTTP/3 frame sequencing, which many generic HTTP/3 clients do not offer by default. The availability impact (A:N) is none, and the availability of confidentiality is also none (C:N); the influence is limited to integrity (I:L) — an attacker cannot exfiltrate data directly but can manipulate the content of requests and responses passed to the backend.

The EPSS score of 0.00297 (21.9% percentile) indicates that this vulnerability is currently not a target of active exploitation in the wild. No CISA KEV listing exists, and no public exploit code or Nuclei templates have been identified, but the underlying primitive (HTTP request smuggling via length mismatch) is well-documented and routinely weaponized in pen-testing toolkits such as smuggler or trufflehog's HTTP desync scanner.

Detection Guidance

Sigma Rule

title: HAProxy HTTP/3 Content-Length Mismatch Detection
id: 3f7a9c2e-8b45-4d6f-9a10-2b3c4d5e6f70
status: experimental
description: Detects potential request smuggling attempts targeting HAProxy H3 parser via Content-Length desynchronization (CVE-2026-33555).
logsource:
    category: application
    product: haproxy
    service: http
detection:
    selection:
        haproxy.mode: http
        haproxy.term_state: "SD"  # server close
    keywords:
        - "h3 stream closed"
        - "content-length mismatch"
        - "H3 frame error"
        - "protocol violation"
    condition: selection and keywords
falsepositives:
    - Legitimate clients closing HTTP/3 streams abruptly
    - Misconfigured HTTP/3 clients sending invalid framing
level: medium
tags:
    - attack.t1190
    - cve.2026.33555
    - cwe.130

YARA Rule

rule HAProxy_H3_Smuggling_Logs
{
    meta:
        author = "ValterSec Threat Intel"
        date = "2026-01-15"
        description = "Detects HAProxy log lines indicating HTTP/3 Content-Length parsing anomalies"
        cve = "CVE-2026-33555"
    strings:
        $log1 = "content-length" ascii nocase
        $log2 = "http3" ascii nocase
        $log3 = "error" ascii nocase
        $log4 = "stream" ascii nocase
        $log5 = "length" ascii nocase
        $log6 = "mismatch" ascii nocase
        $log7 = "frame" ascii nocase
        $log8 = "rejected" ascii nocase
    condition:
        uint16(0) == 0x0A0D or
        ($log1 and ($log3 or $log8) and ($log2 or $log4 or $log7) and ($log5 or $log6))
}

Suricata IDS Rule

alert http3 any any -> any any (msg:"ET H3 HAProxy Content-Length Mismatch (CVE-2026-33555)"; flow:established; http3.frame_type; content:"|00 00 00 00|"; http3.stream; content:"|01 05|"; content:"content-length"; http_header; sid:202633555; rev:1; metadata:attack_target Web_Server, deployment Perimeter, signature_severity Major, created_at 2026_01_15, cve CVE-2026-33555;)

Note: The above Suricata rule is a skeleton. Full HTTP/3 (QUIC) inspection in Suricata requires the http3 keyword support (available in Suricata 7.0.4+). A production rule should also decode and inspect the body-length accumulation across multiple DATA frames. In environments lacking H3 protocol parsing, rely on the HAProxy log-based Sigma rule above.

Elastic Detection

sequence by source.ip, destination.ip with maxspan=5m
  [network where destination.port == 443 and network.transport == "udp"]
  [http where http.version == "3" and http.response.status_code == 200 and http.request.body.bytes != http.request.content_length]

This EQL sequence correlates any HTTP/3 request whose body.bytes count (as parsed by Elastic's HTTP/3 dissector) does not match the announced Content-Length header, indicating a desync event.

Splunk SPL Query

index=proxy sourcetype=haproxy 
| search "http3" ( "content-length" OR "frame error" OR "protocol error" OR "SD" )
| eval parsed_len_len = len(_raw)
| table _time, client_ip, server_ip, backend, http_request, response_code, term_state
| where term_state IN ("SD", "PR") OR match(http_request, "(?i)content-length")
| stats count by client_ip, backend
| where count > 10

Wazuh OSSEC Rule

<group name="haproxy,">
  <rule id="100235" level="10">
    <decoded_as>haproxy</decoded_as>
    <field name="term_state">SD</field>
    <match>http3</match>
    <description>HAProxy detected H3 connection with abrupt termination, possible CVE-2026-33555 smuggling attempt</description>
    <group>web_application_attack,t1190,</group>
  </rule>
  <rule id="100236" level="12">
    <decoded_as>haproxy</decoded_as>
    <match>content-length mismatch</match>
    <description>HAProxy HTTP/3 Content-Length desync detected, aligns with request smuggling CVE-2026-33555</description>
    <group>web_application_attack,t1190,cwe.130,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY — 2 independent sources confirm fix)

1. Immediate Mitigations (if patching is not immediately possible):

   • Disable HTTP/3 support on frontend listeners by removing the h3 protocol binding from the bind line or the proto h3 option. This forces clients to fall back to HTTP/1.1 or HTTP/2, which are not affected by this parser flaw.
   • If HTTP/3 must remain enabled, isolate HAProxy from the public internet behind a WAF or another secure reverse proxy that is not susceptible to this payload.
   • Restrict HTTP/3 listener access via source IP ACLs to known trusted clients only (if the service is not public-facing).

2. Patch and Upgrade Steps:

   • Upgrade to HAProxy 3.3.6 or later. This is the first release containing the fix. The patch was confirmed by both OSV and Debian security trackers.
   • For LTS branches:
     • 2.6 and 2.8 users should migrate to 3.3.6 (or the latest stable) — while HAProxy may backport fixes to older branches, no backport has been confirmed for 2.6 or 2.8 as of this writing.
     • 3.0 users should upgrade to 3.0.x (if a patch is released for that branch) or move to 3.3.6.
   • Verify the fix: after upgrading, send a test HTTP/3 request with a Content-Length: 5 header but body of 1 byte followed by an empty DATA frame; HAProxy should now reject the request with a 400 error or close the stream with a H3_MESSAGE_ERROR frame.

3. Long-Term Hardening:

   • Enable HAProxy's http-use-htx mode (default in 3.x) and consider enabling strict HTTP/3 frame validation via strict-validation or http-request set-var(txn.body_ok) 1 with a custom ACL comparing req.body_len to req.hdr(content-length).
   • Subscribe to the HAProxy security mailing list and maintain a patch-management SLA of no more than 7 days for security-critical releases.
   • Deploy HTTP request smuggling detection monitoring: feed HAProxy logs to a SIEM and implement the Sigma/Elastic/Splunk rules above as alerting logic.
   • Perform periodic penetration testing against the HTTP/3 endpoint using desync-capable tools to verify the parser remains consistent.

References

1. National Vulnerability Database — CVE-2026-33555: https://nvd.nist.gov/vuln/detail/CVE-2026-33555
2. HAProxy Official Release Notes (v3.3.6): https://www.haproxy.org/download/3.3/src/CHANGELOG
3. Debian Security Tracker — DSA/DLA for CVE-2026-33555: https://security-tracker.debian.org/tracker/CVE-2026-33555
4. OSV.dev Advisory for HAProxy CVE-2026-33555: https://osv.dev/vulnerability/CVE-2026-33555
5. HAProxy Git Commit Reference (v3.3.6 fix): https://git.haproxy.org/?p=haproxy.git;a=commit;h=3.3.6

Threat Actor Activity / Exploit-in-the-Wild Evidence: None observed as of this report's publication date. The EPSS score of 0.00297 places this CVE in the bottom 22% for exploitation likelihood, and it is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given the historical prevalence of HTTP request-smuggling techniques (e.g., the 2019 HTTP/2 smuggling wave, the 2020 HAProxy Content-Length race condition), security teams should proactively patch this flaw before weaponization occurs in tooling such as BurpSuite extensions or smuggler.py.