Nixpkgs security tracker
NIXPKGS-2026-1117
GitHub issue
published on
Permalink
CVE-2026-33555
4.0 MEDIUM
- CVSS version: 3.1
- Attack vector (AV):
- Attack complexity (AC):
- Privileges required (PR):
- User interaction (UI):
- Scope (S):
- Confidentiality impact (C):
- Integrity impact (I):
- Availability impact (A):
by @LeSuisse Activity log
- Created automatic suggestion
- @LeSuisse ignored
-
@LeSuisse
ignored
2 packages
- prometheus-haproxy-exporter
- haskellPackages.io-streams-haproxy
- @LeSuisse accepted
- @LeSuisse published on GitHub
An issue was discovered in HAProxy before 3.3.6. The HTTP/3 …
An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.
References
Affected products
HAProxy
- <3.3.6
Matching in nixpkgs
Ignored packages (2)
pkgs.prometheus-haproxy-exporter
HAProxy Exporter for the Prometheus monitoring system
Package maintainers
-
@vifino Adrian Pistol <vifino@tty.sh>