Nixpkgs security tracker
NIXPKGS-2026-1117
GitHub issue
published 2 months ago
Permalink
CVE-2026-33555
4.0 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Changed (C)
- Confidentiality (C): None (N)
- Integrity (I): Low (L)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Changed (C)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): None (N)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
2 packages
- prometheus-haproxy-exporter
- haskellPackages.io-streams-haproxy
- @LeSuisse accepted
- @LeSuisse published on GitHub
An issue was discovered in HAProxy before 3.3.6. The HTTP/3 …
An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.
References
Affected products
HAProxy
- <3.3.6
Matching in nixpkgs
Ignored packages (2)
pkgs.prometheus-haproxy-exporter
HAProxy Exporter for the Prometheus monitoring system
pkgs.haskellPackages.io-streams-haproxy
HAProxy protocol 1.5 support for io-streams
Package maintainers
-
@vifino Adrian Pistol <vifino@tty.sh>