CVE-2026-55203 is an integer overflow vulnerability in HAProxy's FastCGI backend implementation affecting the fcgi_conn structure's drl field. When crafted contentLength and paddingLength values cause the drl field to wrap to zero, the FastCGI framing parser becomes desynchronized. This can result in response smuggling, request routing errors, and memory safety issues. Exploitation requires an attacker to control the FastCGI backend server, making the attack vector limited to specific configurations. Red Hat released a security advisory (RHSA-2026:35453) updating haproxy to version 3.0.25-0.1.hum1 in Red Hat Hardened Images to fix this issue. The advisory recommends restricting access to trusted FastCGI backends or disabling FastCGI support if not required. No known exploits in the wild have been reported.

The vulnerability can cause the FastCGI framing parser in HAProxy to desynchronize, potentially enabling response smuggling, incorrect request routing, or memory safety violations. These impacts could lead to data integrity issues or denial of service conditions. However, exploitation is constrained by the requirement that the attacker must control the FastCGI backend server, limiting exposure to environments with untrusted or compromised backends. There are no reports of active exploitation in the wild.

Red Hat has released an updated haproxy package (3.0.25-0.1.hum1) as part of Red Hat Hardened Images RPMs to address this vulnerability. Users should apply this update to remediate the issue. Additionally, restrict HAProxy FastCGI usage to trusted backend servers only. If FastCGI is not required, disable it in HAProxy configurations to eliminate the attack vector. Ensure backend servers are secured against compromise. Reload or restart HAProxy services after configuration changes to validate the new settings.