Red Hat Product Errata RHSA-2026:55803 - Security Advisory
Issued:
2026-08-17
Updated:
2026-08-17

RHSA-2026:55803 - Security Advisory

Synopsis

Important: haproxy security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for haproxy is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

  • haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)
  • haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64
  • Red Hat Enterprise Linux Server - AUS 9.6 x86_64
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x
  • Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 x86_64
  • Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 aarch64
  • Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 ppc64le
  • Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 s390x

Fixes

  • BZ - 2490518 - CVE-2026-55204 haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions
  • BZ - 2490522 - CVE-2026-55203 haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6

SRPM
haproxy-2.4.22-4.el9_6.3.src.rpm SHA-256: 8b22b3d52dd1e64e529d30d23fc542b198b0d1496e83444201cbb21d1ef940bd
x86_64
haproxy-2.4.22-4.el9_6.3.x86_64.rpm SHA-256: 3495c207822eb5593118cb95e6d4e0e8064362668f0787bf796235194fde1192
haproxy-debuginfo-2.4.22-4.el9_6.3.x86_64.rpm SHA-256: 4324ea8cd1e8588d5032d7662a3cdaa26783979319a4d165a3e60f3f5fb832cb
haproxy-debugsource-2.4.22-4.el9_6.3.x86_64.rpm SHA-256: 68686311749a013758f43cc609a4f0e89a88c7209825434305b541375e0aefd7

Red Hat Enterprise Linux Server - AUS 9.6

SRPM
haproxy-2.4.22-4.el9_6.3.src.rpm SHA-256: 8b22b3d52dd1e64e529d30d23fc542b198b0d1496e83444201cbb21d1ef940bd
x86_64
haproxy-2.4.22-4.el9_6.3.x86_64.rpm SHA-256: 3495c207822eb5593118cb95e6d4e0e8064362668f0787bf796235194fde1192
haproxy-debuginfo-2.4.22-4.el9_6.3.x86_64.rpm SHA-256: 4324ea8cd1e8588d5032d7662a3cdaa26783979319a4d165a3e60f3f5fb832cb
haproxy-debugsource-2.4.22-4.el9_6.3.x86_64.rpm SHA-256: 68686311749a013758f43cc609a4f0e89a88c7209825434305b541375e0aefd7

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6

SRPM
haproxy-2.4.22-4.el9_6.3.src.rpm SHA-256: 8b22b3d52dd1e64e529d30d23fc542b198b0d1496e83444201cbb21d1ef940bd
s390x
haproxy-2.4.22-4.el9_6.3.s390x.rpm SHA-256: 6b3b868634d451ab6b6bab300b89f7e028be3e5e2482ab7d337267dc12a2488c
haproxy-debuginfo-2.4.22-4.el9_6.3.s390x.rpm SHA-256: 327e80f585da237b864947b2b09ef2e3f91d772dcabd6a26365ef7228288be25
haproxy-debugsource-2.4.22-4.el9_6.3.s390x.rpm SHA-256: 779d902f57fa55f921fc72c1573a7dfd54576e35532cddf876a829414a7eebfe

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6

SRPM
haproxy-2.4.22-4.el9_6.3.src.rpm SHA-256: 8b22b3d52dd1e64e529d30d23fc542b198b0d1496e83444201cbb21d1ef940bd
ppc64le
haproxy-2.4.22-4.el9_6.3.ppc64le.rpm SHA-256: 939c82f999c071e38f5ec936a5c26de60e2fdf9da29c5c112e151004c27e8a6a
haproxy-debuginfo-2.4.22-4.el9_6.3.ppc64le.rpm SHA-256: f031ad47a7bf30a57a65e98d538c53bed46eeacefa86258f5659f055eeda7741
haproxy-debugsource-2.4.22-4.el9_6.3.ppc64le.rpm SHA-256: 22bdcb0540a32049953f3f3dffb5ccb1723af4cbbc53feb057a7eaa1210a4d2f

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6

SRPM
haproxy-2.4.22-4.el9_6.3.src.rpm SHA-256: 8b22b3d52dd1e64e529d30d23fc542b198b0d1496e83444201cbb21d1ef940bd
aarch64
haproxy-2.4.22-4.el9_6.3.aarch64.rpm SHA-256: bfaba1b0f313d13beae32a1ec828e4fe494300dce7ffc2567e623c6927f115d6
haproxy-debuginfo-2.4.22-4.el9_6.3.aarch64.rpm SHA-256: 1a1fd496b1e085e3fcf1909259c1e8c341ec42bcb5dcf6a6d8c9172c079945d4
haproxy-debugsource-2.4.22-4.el9_6.3.aarch64.rpm SHA-256: e65d46b4add62755fb257cc05f9c54f3e8a794e03ccf73dd0e634f6ea460af7f

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6

SRPM
haproxy-2.4.22-4.el9_6.3.src.rpm SHA-256: 8b22b3d52dd1e64e529d30d23fc542b198b0d1496e83444201cbb21d1ef940bd
ppc64le
haproxy-2.4.22-4.el9_6.3.ppc64le.rpm SHA-256: 939c82f999c071e38f5ec936a5c26de60e2fdf9da29c5c112e151004c27e8a6a
haproxy-debuginfo-2.4.22-4.el9_6.3.ppc64le.rpm SHA-256: f031ad47a7bf30a57a65e98d538c53bed46eeacefa86258f5659f055eeda7741
haproxy-debugsource-2.4.22-4.el9_6.3.ppc64le.rpm SHA-256: 22bdcb0540a32049953f3f3dffb5ccb1723af4cbbc53feb057a7eaa1210a4d2f

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6

SRPM
haproxy-2.4.22-4.el9_6.3.src.rpm SHA-256: 8b22b3d52dd1e64e529d30d23fc542b198b0d1496e83444201cbb21d1ef940bd
x86_64
haproxy-2.4.22-4.el9_6.3.x86_64.rpm SHA-256: 3495c207822eb5593118cb95e6d4e0e8064362668f0787bf796235194fde1192
haproxy-debuginfo-2.4.22-4.el9_6.3.x86_64.rpm SHA-256: 4324ea8cd1e8588d5032d7662a3cdaa26783979319a4d165a3e60f3f5fb832cb
haproxy-debugsource-2.4.22-4.el9_6.3.x86_64.rpm SHA-256: 68686311749a013758f43cc609a4f0e89a88c7209825434305b541375e0aefd7

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6

SRPM
haproxy-2.4.22-4.el9_6.3.src.rpm SHA-256: 8b22b3d52dd1e64e529d30d23fc542b198b0d1496e83444201cbb21d1ef940bd
aarch64
haproxy-2.4.22-4.el9_6.3.aarch64.rpm SHA-256: bfaba1b0f313d13beae32a1ec828e4fe494300dce7ffc2567e623c6927f115d6
haproxy-debuginfo-2.4.22-4.el9_6.3.aarch64.rpm SHA-256: 1a1fd496b1e085e3fcf1909259c1e8c341ec42bcb5dcf6a6d8c9172c079945d4
haproxy-debugsource-2.4.22-4.el9_6.3.aarch64.rpm SHA-256: e65d46b4add62755fb257cc05f9c54f3e8a794e03ccf73dd0e634f6ea460af7f

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6

SRPM
haproxy-2.4.22-4.el9_6.3.src.rpm SHA-256: 8b22b3d52dd1e64e529d30d23fc542b198b0d1496e83444201cbb21d1ef940bd
s390x
haproxy-2.4.22-4.el9_6.3.s390x.rpm SHA-256: 6b3b868634d451ab6b6bab300b89f7e028be3e5e2482ab7d337267dc12a2488c
haproxy-debuginfo-2.4.22-4.el9_6.3.s390x.rpm SHA-256: 327e80f585da237b864947b2b09ef2e3f91d772dcabd6a26365ef7228288be25
haproxy-debugsource-2.4.22-4.el9_6.3.s390x.rpm SHA-256: 779d902f57fa55f921fc72c1573a7dfd54576e35532cddf876a829414a7eebfe

Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6

SRPM
haproxy-2.4.22-4.el9_6.3.src.rpm SHA-256: 8b22b3d52dd1e64e529d30d23fc542b198b0d1496e83444201cbb21d1ef940bd
x86_64
haproxy-2.4.22-4.el9_6.3.x86_64.rpm SHA-256: 3495c207822eb5593118cb95e6d4e0e8064362668f0787bf796235194fde1192
haproxy-debuginfo-2.4.22-4.el9_6.3.x86_64.rpm SHA-256: 4324ea8cd1e8588d5032d7662a3cdaa26783979319a4d165a3e60f3f5fb832cb
haproxy-debugsource-2.4.22-4.el9_6.3.x86_64.rpm SHA-256: 68686311749a013758f43cc609a4f0e89a88c7209825434305b541375e0aefd7

Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6

SRPM
haproxy-2.4.22-4.el9_6.3.src.rpm SHA-256: 8b22b3d52dd1e64e529d30d23fc542b198b0d1496e83444201cbb21d1ef940bd
aarch64
haproxy-2.4.22-4.el9_6.3.aarch64.rpm SHA-256: bfaba1b0f313d13beae32a1ec828e4fe494300dce7ffc2567e623c6927f115d6
haproxy-debuginfo-2.4.22-4.el9_6.3.aarch64.rpm SHA-256: 1a1fd496b1e085e3fcf1909259c1e8c341ec42bcb5dcf6a6d8c9172c079945d4
haproxy-debugsource-2.4.22-4.el9_6.3.aarch64.rpm SHA-256: e65d46b4add62755fb257cc05f9c54f3e8a794e03ccf73dd0e634f6ea460af7f

Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6

SRPM
haproxy-2.4.22-4.el9_6.3.src.rpm SHA-256: 8b22b3d52dd1e64e529d30d23fc542b198b0d1496e83444201cbb21d1ef940bd
ppc64le
haproxy-2.4.22-4.el9_6.3.ppc64le.rpm SHA-256: 939c82f999c071e38f5ec936a5c26de60e2fdf9da29c5c112e151004c27e8a6a
haproxy-debuginfo-2.4.22-4.el9_6.3.ppc64le.rpm SHA-256: f031ad47a7bf30a57a65e98d538c53bed46eeacefa86258f5659f055eeda7741
haproxy-debugsource-2.4.22-4.el9_6.3.ppc64le.rpm SHA-256: 22bdcb0540a32049953f3f3dffb5ccb1723af4cbbc53feb057a7eaa1210a4d2f

Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6

SRPM
haproxy-2.4.22-4.el9_6.3.src.rpm SHA-256: 8b22b3d52dd1e64e529d30d23fc542b198b0d1496e83444201cbb21d1ef940bd
s390x
haproxy-2.4.22-4.el9_6.3.s390x.rpm SHA-256: 6b3b868634d451ab6b6bab300b89f7e028be3e5e2482ab7d337267dc12a2488c
haproxy-debuginfo-2.4.22-4.el9_6.3.s390x.rpm SHA-256: 327e80f585da237b864947b2b09ef2e3f91d772dcabd6a26365ef7228288be25
haproxy-debugsource-2.4.22-4.el9_6.3.s390x.rpm SHA-256: 779d902f57fa55f921fc72c1573a7dfd54576e35532cddf876a829414a7eebfe

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.