r3verii/CVE-2026-33555
PoCOne zero-byte QUIC packet is enough to desynchronize HAProxy's backend connection pool and smuggle HTTP requests across unrelated users — even users on a completely different frontend protocol.
01
exploited CVEs (1)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-33555US | medium5.8 | Exploit | ||
An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is clo… | ||||
scry
Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.
Free scan