HAProxy · week of 26 Oct 2026
HAProxy security note
Records on this stack that changed between 26 Oct 2026 and the following Monday. Versions come from the stored ranges. A quiet week is not proof the stack is clear.
What changed
CVE-2023-44487 — Patch now
HTTP/2 Rapid Reset Attack Vulnerability
Seen in 1.7.3-2 · 3 other packages on the advisory
CVE-2026-55203 — Check if you run it
HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record hea
Seen in 2.6.12-1 · 3 other packages on the advisory
What we still do not know
Every changed record in this note has a version range.
Share this note
HAProxy security note, week of 26 Oct 2026: 2 records have a version a customer can check, and 0 still do not. https://zerodayfindings.com/technologies/haproxy/notes/2026-W44