diff --git a/CVE-2026-55203.patch b/CVE-2026-55203.patch
new file mode 100644
index 0000000000000000000000000000000000000000..5c38c854e03a3b2cba96b053054decba8e61e0c4
--- /dev/null
+++ b/CVE-2026-55203.patch
@@ -0,0 +1,34 @@
+From 5985276735777634d8c85f1d73bb7764aab0d6dd Mon Sep 17 00:00:00 2001
+From: Tristan Madani <tristan@talencesecurity.com>
+Date: Tue, 16 Jun 2026 08:46:03 +0200
+Subject: [PATCH] BUG/MEDIUM: mux-fcgi: fix uint16_t overflow in drl += drp
+
+The FCGI demux record length field (drl) is uint16_t. In the
+ignore_record path, the expression "fconn->drl += fconn->drp" overflows
+to 0 when contentLength=65535 and paddingLength>=1. This causes the
+state machine to consider the record complete without consuming any
+buffer data. The remaining buffer contents are then parsed as new FCGI
+record headers.
+
+The same drl+=drp pattern at lines 2382/2418/2475 is not affected
+because drl is guaranteed to be 0 at those points (all content bytes
+are consumed before reaching end_transfer).
+
+Widen drl from uint16_t to uint32_t so that the addition of drp
+(uint8_t, max 255) cannot overflow.
+
+Reported-by: Tristan (@TristanInSec)
+
+CVE-2026-55203 was assigned to this issue.
+---
+ src/mux_fcgi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/mux_fcgi.c b/src/mux_fcgi.c
+--- a/src/mux_fcgi.c
++++ b/src/mux_fcgi.c
+@@ -56,3 +56,3 @@ struct fcgi_conn {
+ 	int16_t  dsi;                        /* dmux stream ID (<0 = idle ) */
+-	uint16_t drl;                        /* demux record length (if dsi >= 0) */
++	uint32_t drl;                        /* demux record length (if dsi >= 0) */
+ 	uint8_t  drt;                        /* demux record type (if dsi >= 0) */
diff --git a/haproxy.spec b/haproxy.spec
index ff86198b8bddc92f13c07b5e381f744f465565cb..999f6de7c23001a818afd20af9c31f9c2a9fdfa0 100644
--- a/haproxy.spec
+++ b/haproxy.spec
@@ -1,4 +1,4 @@
-%define anolis_release  1
+%define anolis_release  2
 %define haproxy_user    haproxy
 %define haproxy_group   %{haproxy_user}
 %define haproxy_homedir %{_localstatedir}/lib/haproxy
@@ -25,6 +25,10 @@ Source6:        halog.1
 
 # https://github.com/haproxy/haproxy/commit/06675db4bf234ed17e14305f1d59259d2fe78b06.patch
 Patch1:         1-bugfix-for-CVE-2025-11230.patch
+# CVE-2026-55203
+# Source: upstream
+# Reference: https://github.com/haproxy/haproxy/commit/5985276735777634d8c85f1d73bb7764aab0d6dd
+Patch2: CVE-2026-55203.patch
 
 BuildRequires:  gcc
 BuildRequires:  lua-devel
@@ -148,6 +152,10 @@ done
 %doc CHANGELOG VERSION
 
 %changelog
+* Sat Aug 29 2026 PengLAI Code <rel-eng@openanolis.org> - 3.2.0-2
+- Fix CVE-2026-55203
+- Upstream patch: https://github.com/haproxy/haproxy/commit/5985276735777634d8c85f1d73bb7764aab0d6dd
+
 * Wed Jan 07 2026 lzq11122 <lzq02303433@alibaba-inc.com> - 3.2.0-1
 - Update to 3.2.0 for fix CVE-2025-59303
 - Remove patch new version include