CVE-2026-33555

MediumCVSS 5.8/10Last modified Oct 18, 2026

Description

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

Metrics

CVSS 3.1 5.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-130

Affected software

No affected versions have been published.

Timeline

Published
Apr 13, 2026
Last modified
Oct 18, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-335579.1A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.clasCVE-2026-335585.3Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responsCVE-2026-335595.1WordPress Plugin "OpenStreetMap" provided by MiKa contains a cross-site scripting vulnerability. On the site with the affected version of thCVE-2026-33569.3The MS27102A Remote Spectrum Monitor is vulnerable to an authentication bypass that allows unauthorized users to access and manipulate its mCVE-2026-335608.8The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated CVE-2026-335653.3in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.CVE-2026-335665.1There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of theCVE-2026-335689.1A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.CVE-2026-335696.5Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on‑path attackers to sniff credentials and session data, which canCVE-2026-33578.8IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an inCVE-2026-335705.7PowerSYSTEM Center REST API endpoint for devices allows a low privilege authenticated user to access information normally limited by operatiCVE-2026-335725.5OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcr