UBUNTU-CVE-2026-110353: High severity ubuntu/haproxy vulnerability

Q: Which deployments are exposed to this issue?

HAProxy deployments that accept HTTP/2 connections are exposed if they run a version before 3.4.6. The issue is triggered through an HTTP/2 PING frame, so services not accepting HTTP/2 traffic are not described as affected by the available data.

Q: What does an attacker need to exploit it?

An attacker only needs network access to the HAProxy service and does not need authentication or user interaction. They send a truncated HTTP/2 PING frame and can open many connections to sustain worker-thread CPU exhaustion.

Q: What is the operational impact?

Affected worker threads can spin at high CPU usage until the configured http-request timeout closes each malicious connection. Repeated connections can sustain high CPU consumption and cause a denial of service.

Q: What can be done if upgrading is not immediately possible?

The available data identifies the http-request timeout as the mechanism that eventually closes the malicious connection. Reducing exposure to untrusted HTTP/2 traffic and ensuring this timeout is configured can limit how long individual connections consume CPU, but no complete workaround is specified.

Published Oct 22, 2026

Updated

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.

Affected Software

7 affected componentsFixes available

ubuntu/haproxy*

ubuntu/haproxy<2.4.30-0ubuntu0.22.04.3

2.4.30-0ubuntu0.22.04.3

ubuntu/haproxy<2.8.30-0ubuntu0.24.04.2

2.8.30-0ubuntu0.24.04.2

ubuntu/haproxy<3.4.2-1ubuntu4.1

3.4.2-1ubuntu4.1

ubuntu/haproxy<3.2.25-0ubuntu0.26.04.2

3.2.25-0ubuntu0.26.04.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/haproxy to a version that resolves this vulnerability.
Fixed in 2.4.30-0ubuntu0.22.04.3
Upgrade
Upgrade ubuntu/haproxy to a version that resolves this vulnerability.
Fixed in 2.8.30-0ubuntu0.24.04.2
Upgrade
Upgrade ubuntu/haproxy to a version that resolves this vulnerability.
Fixed in 3.4.2-1ubuntu4.1
Upgrade
Upgrade ubuntu/haproxy to a version that resolves this vulnerability.
Fixed in 3.2.25-0ubuntu0.26.04.2

Event History

Oct 22, 2026

CVE Published

via OSV·03:16 AM

Data Sourced

via OSV·03:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

HAProxy deployments that accept HTTP/2 connections are exposed if they run a version before 3.4.6. The issue is triggered through an HTTP/2 PING frame, so services not accepting HTTP/2 traffic are not described as affected by the available data.

What does an attacker need to exploit it?

An attacker only needs network access to the HAProxy service and does not need authentication or user interaction. They send a truncated HTTP/2 PING frame and can open many connections to sustain worker-thread CPU exhaustion.

What is the operational impact?

Affected worker threads can spin at high CPU usage until the configured http-request timeout closes each malicious connection. Repeated connections can sustain high CPU consumption and cause a denial of service.

What can be done if upgrading is not immediately possible?

The available data identifies the http-request timeout as the mechanism that eventually closes the malicious connection. Reducing exposure to untrusted HTTP/2 traffic and ensuring this timeout is configured can limit how long individual connections consume CPU, but no complete workaround is specified.

UBUNTU-CVE-2026-110353: High severity ubuntu/haproxy vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the operational impact?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the operational impact?

What can be done if upgrading is not immediately possible?