diff --git a/CVE-2026-33555.patch b/CVE-2026-33555.patch
new file mode 100644
index 0000000000000000000000000000000000000000..dde929ab0add2f7972080952478ba43c95e15b15
--- /dev/null
+++ b/CVE-2026-33555.patch
@@ -0,0 +1,52 @@
+From 05a295441c621089ffa4318daf0dbca2dd756a84 Mon Sep 17 00:00:00 2001
+From: Amaury Denoyelle <adenoyelle@haproxy.com>
+Date: Wed, 18 Mar 2026 09:24:32 +0100
+Subject: [PATCH] BUG/MAJOR: h3: check body size with content-length on empty
+ FIN
+
+In QUIC, a STREAM frame may be received with no data but with FIN bit
+set. This situation is tedious to handle and haproxy parsing code has
+changed several times to deal with this situation. Now, H3 and H09
+layers parsing code are skipped in favor of the shared function
+qcs_http_handle_standalone_fin() used to handle the HTX EOM emission.
+
+However, this shortcut bypasses an important HTTP/3 validation check on
+the received body size vs the announced content-length header. Under
+some conditions, this could cause a desynchronization with the backend
+server which could be exploited for request smuggling.
+
+Fix HTTP/3 parsing code by adding a call to h3_check_body_size() prior
+to qcs_http_handle_standalone_fin() if content-length header has been
+found. If the body size is incorrect, the stream is immediately resetted
+with H3_MESSAGE_ERROR code and the error is forwarded to the stream
+layer.
+
+Thanks to Martino Spagnuolo for his detailed report on this issue and
+for having contacting us about it via the security mailing list.
+
+This must be backported up to 2.6.
+
+Fix CVE-2026-33555
+
+Reference: https://git.haproxy.org/?p=haproxy.git;a=commit;h=05a295441c621089ffa4318daf0dbca2dd756a84
+Adapted-by: PengLAI Code <rel-eng@openanolis.org>
+---
+ src/h3.c |   8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/src/h3.c b/src/h3.c
+--- a/src/h3.c
++++ b/src/h3.c
+@@ -1438,4 +1438,12 @@
+ 	if (!b_data(b) && fin && quic_stream_is_bidi(qcs->id)) {
+ 		TRACE_PROTO("received FIN without data", H3_EV_RX_FRAME, qcs->qcc->conn, qcs);
++
++		/* FIN received, ensure body length is conform to any content-length header. */
++		if ((h3s->flags & H3_SF_HAVE_CLEN) && h3_check_body_size(qcs, 1)) {
++			qcc_abort_stream_read(qcs);
++			qcc_reset_stream(qcs, h3s->err);
++			goto done;
++		}
++
+ 		if (qcs_http_handle_standalone_fin(qcs)) {
+ 			TRACE_ERROR("cannot set EOM", H3_EV_RX_FRAME, qcs->qcc->conn, qcs);
diff --git a/haproxy.spec b/haproxy.spec
index ff86198b8bddc92f13c07b5e381f744f465565cb..54ab5f342240abd0452c6fac74bf0ba6f236e13e 100644
--- a/haproxy.spec
+++ b/haproxy.spec
@@ -1,4 +1,4 @@
-%define anolis_release  1
+%define anolis_release  2
 %define haproxy_user    haproxy
 %define haproxy_group   %{haproxy_user}
 %define haproxy_homedir %{_localstatedir}/lib/haproxy
@@ -25,6 +25,10 @@ Source6:        halog.1
 
 # https://github.com/haproxy/haproxy/commit/06675db4bf234ed17e14305f1d59259d2fe78b06.patch
 Patch1:         1-bugfix-for-CVE-2025-11230.patch
+# CVE-2026-33555
+# Source: upstream
+# Reference: https://github.com/haproxy/haproxy/commit/05a295441c621089ffa4318daf0dbca2dd756a84
+Patch2: CVE-2026-33555.patch
 
 BuildRequires:  gcc
 BuildRequires:  lua-devel
@@ -148,6 +152,11 @@ done
 %doc CHANGELOG VERSION
 
 %changelog
+* Sat Aug 29 2026 PengLAI Code <rel-eng@openanolis.org> - 3.2.0-2
+- Fix CVE-2026-33555
+- Upstream patch: https://github.com/haproxy/haproxy/commit/05a295441c621089ffa4318daf0dbca2dd756a84
+- Adapted by PengLAI Code
+
 * Wed Jan 07 2026 lzq11122 <lzq02303433@alibaba-inc.com> - 3.2.0-1
 - Update to 3.2.0 for fix CVE-2025-59303
 - Remove patch new version include