[Under Evaluation – CVE-2026-55203]: HAProxy through 3.4.0 has an integer overflow in the fcgi_conn drl field where contentLength=65535 with paddingLength>=1 wraps drl to 0, misparsing buffer data as new FCGI record headers. A malicious FastCGI backend can desync the demux parser, causing request routing errors, response smuggling, or memory safety issues. Patch via commit 5985276.