Skip to content
OpenAdvisories
High ALSA-2026:55859 1 CVE

Important: haproxy security update

Published Aug 17, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

* haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
AlmaLinux · 8 haproxy 1.8.27-5.el8_10.2

Vulnerabilities 1

  • High 7.5
    CVE-2026-55204

    HAProxy - NULL Pointer Dereference in hpack_dht_insert Function

    HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can tri…

    HAProxy HAProxy haproxy haproxy Debian Ubuntu Azure Linux Wolfi

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-55204
  • report
    https://bugzilla.redhat.com/2490518
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-55859.html