CVE-2026-110353: High severity HAProxy HAProxy vulnerability
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
HAProxy versions 3.2 through versions before 3.4.6 are affected. The issue is reachable remotely over HTTP/2 and does not require authentication or user interaction.
What does an attacker need to do to trigger the issue?
An attacker must send a truncated HTTP/2 PING frame. By opening many connections that retain incomplete frame data, the attacker can sustain worker-thread CPU usage until connections are closed by the http-request timeout.
Does the HTTP request timeout fully prevent exploitation?
No. The timeout eventually closes each affected connection, but the worker thread can spin until then. An attacker can maintain high CPU usage by opening many such connections.
What is the available remediation?
Upgrade HAProxy to version 3.4.6 or later. The referenced upstream commit adds the missing handling for a short read in the HTTP/2 PING-frame handler.