Description
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HAProxy | HAProxy | 3.2.0 – < 3.2.26, 3.3.0 – < 3.3.17, 3.4.0 – < 3.4.6, 3.5-dev – < 3.5-dev9 | 3.2.26 |
| HAProxy | HAProxy Enterprise Edition | 3.2.0r1 – < 3.2r1-378.1259, 3.3.0r1 – < 3.3r1-377.1005 | 3.2r1-378.1259 |
| HAProxy | Kubernetes Ingress Controller | 3.2.0 – < 3.2.17 | 3.2.17 |
| Haproxy | Kubernetes Ingress Controller Enterprise | 3.2.0 – < 3.2.17-ee1, 3.0 – < 3.0.16-ee17, 1.11 – < 1.11.14-ee11 | 3.2.17-ee1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | haproxy | 3.2.26-1 | — |
| Debian 13 | haproxy | No fix yet | — |
| Debian 12 | haproxy | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | haproxy | 3.4.2-1ubuntu4.1 | USN-8972-1 |
| Ubuntu 26.04 LTS | haproxy | 3.2.25-0ubuntu0.26.04.2 | USN-8972-1 |
| Ubuntu 24.04 LTS | haproxy | 2.8.30-0ubuntu0.24.04.2 | USN-8972-1 |
| Ubuntu 22.04 LTS | haproxy | 2.4.30-0ubuntu0.22.04.3 | USN-8972-1 |
| Ubuntu 20.04 LTS | haproxy | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | haproxy | No fix yet | — |
| Ubuntu Pro 16.04 LTS | haproxy | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | haproxy | 3.0.30-0.1.hum1 | RHSA-2026:83844 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | haproxy | 3.4.7+git57.0faeaeda6-2.1 | openSUSE-SU-2026:12431-1 |
Advisories 4
- RHSA-2026:83844 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- openSUSE-SU-2026:12431-1 haproxy-3.4.7+git57.0faeaeda6-2.1 on GA media SUSE / openSUSE Security Updates · Nov 6, 2026
- WID-SEC-2026-4114 HAProxy: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 5, 2026
- USN-8972-1 haproxy vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026