Summary
It was discovered that HAProxy incorrectly handled truncated HTTP/2
PING frames. A remote attacker could possibly use this issue to cause
HAProxy to consume excessive CPU resources, leading to a denial of
service. (CVE-2026-110353)
It was discovered that HAProxy incorrectly handled certain HTTP/1.1
chunked requests. A remote attacker could possibly use this issue to
cause HAProxy to consume excessive CPU resources, leading to a denial
of service. (CVE-2026-110354)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | haproxy | 2.4.30-0ubuntu0.22.04.3 |
| Ubuntu · 24.04 LTS 24.04:LTS | haproxy | 2.8.30-0ubuntu0.24.04.2 |
| Ubuntu · 26.04 LTS 26.04:LTS | haproxy | 3.2.25-0ubuntu0.26.04.2 |
| Ubuntu · 26.10 | haproxy | 3.4.2-1ubuntu4.1 |
Vulnerabilities 2
-
High 7.5
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhau…
-
High 7.5
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread …