CVE-2026-33555

CVE-2026-33555 is an HTTP/3 parser validation flaw in HAProxy versions 2.6 through 3.3.5 that fails to verify the received body length matches the announced content-length header when streams close via empty payload frames. This validation gap creates desynchronization between HAProxy and backend servers, enabling potential HTTP request smuggling attacks. The vulnerability carries a CVSS v3.1 base score of 4.0 (MEDIUM) with a network attack vector, high attack complexity, and no special privileges required. The impact is limited to integrity violations with no confidentiality or availability impact. The EPSS score of 0.00012 indicates minimal real-world exploitation likelihood relative to the broader CVE ecosystem. The vulnerability shows no active exploitation status, with no known public exploit code available and no inclusion in the CISA Known Exploited Vulnerabilities catalog. The inactive status on security hot lists suggests limited community attention and low immediate threat prioritization. Organizations running HAProxy should plan upgrades to version 3.3.6 or later within normal patch management cycles.