CVE-2026-33555 is a vulnerability in HAProxy's HTTP/3 parser where it fails to verify that the received body length matches the announced content-length if a stream closes with an empty payload. This flaw can cause desynchronization with the backend server, enabling HTTP request smuggling attacks. Such attacks may allow an attacker to bypass security mechanisms and access unauthorized resources. The vulnerability is tracked under CWE-130 (Improper Handling of Length Parameter Inconsistency). Red Hat has published an advisory (RHSA-2026:8749) addressing this issue in Red Hat Hardened Images RPMs, specifically haproxy-3.0.19-1.1.hum1 for aarch64 and x86_64 architectures. No patch or mitigation that meets Red Hat's standards for ease of deployment and applicability is currently available. The vulnerability has medium severity, with a network attack vector and high attack complexity, requiring no privileges or user interaction. Red Hat remains the authoritative source for this vulnerability's impact on its products.

The vulnerability allows remote attackers to perform HTTP request smuggling by exploiting a desynchronization between the frontend HTTP/3 parser and the backend server. This can lead to bypassing security controls and potentially accessing unauthorized resources. The impact is rated as medium with low integrity impact and no confidentiality or availability impact according to Red Hat's assessment. The attack complexity is high, and no privileges or user interaction are required.

Currently, no mitigation is available or meets Red Hat's criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates regarding patches or mitigations. Until a fix is released, consider limiting exposure of affected HAProxy instances to untrusted networks if possible. Customers with Red Hat Technical Account Managers (TAM) can consult them for tailored guidance. Applying a fix is recommended once it becomes available.