USN-8972-1: HAProxy vulnerabilities
It was discovered that HAProxy incorrectly handled truncated HTTP/2 PING frames. A remote attacker could possibly use this issue to cause HAProxy to consume excessive CPU resources, leading to a denial of service. (CVE-2026-110353)
It was discovered that HAProxy incorrectly handled certain HTTP/1.1 chunked requests. A remote attacker could possibly use this issue to cause HAProxy to consume excessive CPU resources, leading to a denial of service. (CVE-2026-110354)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/haproxyto a version that resolves this vulnerability.Fixed in 3.4.2-1ubuntu4.1 - Upgrade
Upgrade
ubuntu/haproxyto a version that resolves this vulnerability.Fixed in 3.2.25-0ubuntu0.26.04.2 - Upgrade
Upgrade
ubuntu/haproxyto a version that resolves this vulnerability.Fixed in 2.8.30-0ubuntu0.24.04.2 - Upgrade
Upgrade
ubuntu/haproxyto a version that resolves this vulnerability.Fixed in 2.4.30-0ubuntu0.22.04.3
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Who can exploit these issues?
A remote attacker may be able to exploit them by sending malformed traffic to an HAProxy instance. CVE-2026-110353 involves truncated HTTP/2 PING frames, while CVE-2026-110354 involves certain HTTP/1.1 chunked requests.
What is the likely impact of successful exploitation?
Both issues may cause HAProxy to consume excessive CPU resources, resulting in a denial of service.
Which HAProxy package update is identified in the available data?
The referenced Ubuntu source package version is haproxy 3.4.2-1ubuntu4.1.