BIT-haproxy-2026-55204: HAProxy - NULL Pointer Dereference in hpack_dht_insert Function

Q: What conditions are required to trigger the crash?

An attacker needs to cause HPACK dynamic table insertions while HAProxy's relevant memory pool is exhausted. The vulnerable code does not validate a failed hpack_dht_defrag() return value, leading to a NULL pointer dereference.

Q: What is the practical impact on an affected deployment?

Successful exploitation can crash HAProxy worker processes, resulting in denial of service. The provided vector indicates the issue can be exploited remotely without privileges or user interaction.

Q: Which versions are affected and what fix is available?

HAProxy through 3.4.0 is affected. The issue is fixed in commit 9a6d1fe.

Published Jun 18, 2026

Updated

HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpackdhtinsert() within src/hpack-tbl.c that fails to validate the return value of hpackdhtdefrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.

Affected Software

1 affected component

HAProxy HAProxy<=3.4.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade HAProxy to a version that resolves this vulnerability.
Patch 9a6d1fe

Event History

Jun 18, 2026

CVE Published

via OSV·04:05 PM

Data Sourced

via OSV·04:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required to trigger the crash?

An attacker needs to cause HPACK dynamic table insertions while HAProxy's relevant memory pool is exhausted. The vulnerable code does not validate a failed hpack_dht_defrag() return value, leading to a NULL pointer dereference.

What is the practical impact on an affected deployment?

Successful exploitation can crash HAProxy worker processes, resulting in denial of service. The provided vector indicates the issue can be exploited remotely without privileges or user interaction.

Which versions are affected and what fix is available?

HAProxy through 3.4.0 is affected. The issue is fixed in commit 9a6d1fe.

BIT-haproxy-2026-55204: HAProxy - NULL Pointer Dereference in hpack_dht_insert Function

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required to trigger the crash?

What is the practical impact on an affected deployment?

Which versions are affected and what fix is available?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger the crash?

What is the practical impact on an affected deployment?

Which versions are affected and what fix is available?