REDHAT-BUG-2490518: Null Pointer Dereference

Q: What conditions are required for exploitation?

HAProxy deployments that process HTTP/2 traffic are exposed when an attacker can cause HPACK dynamic table insertions while the relevant memory pool is exhausted. Successful exploitation crashes HAProxy worker processes, resulting in denial of service.

Q: Which versions are affected and what fixes the issue?

The issue affects HAProxy through version 3.4.0. It is fixed by commit 9a6d1fe.

Published Jun 18, 2026

Updated

HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpackdhtinsert() within src/hpack-tbl.c that fails to validate the return value of hpackdhtdefrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.

Affected Software

1 affected component

HAProxy HAProxy<=3.4.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade haproxy to a version that resolves this vulnerability.
Fixed in 3.4.0Patch 9a6d1fe
Upgrade
Upgrade haproxy to a version that resolves this vulnerability.
Patch 9a6d1fe

Event History

Jun 18, 2026

Data Sourced

via Red Hat·05:02 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required for exploitation?

HAProxy deployments that process HTTP/2 traffic are exposed when an attacker can cause HPACK dynamic table insertions while the relevant memory pool is exhausted. Successful exploitation crashes HAProxy worker processes, resulting in denial of service.

Which versions are affected and what fixes the issue?