Bug 2490522 (CVE-2026-55203)
| Summary: | CVE-2026-55203 haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | amctagga, aoconnor, bniver, flucifre, gmeno, groman, mbenjamin, mhackett, rhel-process-autobot, sostapov, vereddy, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in HAProxy. A malicious FastCGI (Fast Common Gateway Interface) backend can exploit an integer overflow vulnerability in the fcgi_conn structure's drl field. This occurs when specific contentLength and paddingLength values cause the drl field to wrap to zero, leading to incorrect record consumption. This desynchronizes the FCGI framing parser, potentially resulting in response smuggling, request routing errors, or memory safety issues.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2501068 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-06-18 17:02:24 UTC
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:55679 https://access.redhat.com/errata/RHSA-2026:55679 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:55772 https://access.redhat.com/errata/RHSA-2026:55772 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:55800 https://access.redhat.com/errata/RHSA-2026:55800 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:55801 https://access.redhat.com/errata/RHSA-2026:55801 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:55802 https://access.redhat.com/errata/RHSA-2026:55802 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:55803 https://access.redhat.com/errata/RHSA-2026:55803 |