RHSA-2026:55859: Important: haproxy security update
The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.Security Fix(es): haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/haproxyto a version that resolves this vulnerability.Fixed in 1.8.27-5.el8_10.2 - Upgrade
Upgrade
redhat/haproxy-debuginfoto a version that resolves this vulnerability.Fixed in 1.8.27-5.el8_10.2 - Upgrade
Upgrade
redhat/haproxy-debugsourceto a version that resolves this vulnerability.Fixed in 1.8.27-5.el8_10.2 - Upgrade
Upgrade
redhat/haproxyto a version that resolves this vulnerability.Fixed in 1.8.27-5.el8_10.2.aa - Upgrade
Upgrade
redhat/haproxy-debuginfoto a version that resolves this vulnerability.Fixed in 1.8.27-5.el8_10.2.aa - Upgrade
Upgrade
redhat/haproxy-debugsourceto a version that resolves this vulnerability.Fixed in 1.8.27-5.el8_10.2.aa - Upgrade
Upgrade
haproxyto a version that resolves this vulnerability.Patch CVE-2026-55204
Event History
Frequently Asked Questions
Which deployed software should be reviewed for this update?
Systems running the Red Hat haproxy package are in scope, including the associated haproxy-debuginfo and haproxy-debugsource packages listed in the advisory. The issue affects HAProxy handling of HPACK dynamic table insertions.
What is known about exploitation prerequisites and interim mitigation?
The advisory identifies the impact as denial of service. It does not provide exploit prerequisites, affected configuration details, or a temporary mitigation; review the referenced erratum and CVE information when planning remediation if the update cannot be applied immediately.