HAProxy allows denial of service via HTTP/2 PING frames (CVE-2026-110353)
Remote attackers can trigger CPU exhaustion and denial of service in HAProxy servers through malformed HTTP/2 PING frames.
40
CVE-2026-110353
Unauthenticated DoS in HAProxy via truncated HTTP/2 PING
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
HAProxy 3.2 before 3.4.6 fails to check for a short read when handling an HTTP/2 PING frame. A remote unauthenticated attacker can send a truncated PING so the H2 multiplexer repeatedly wakes on unconsumed data and spins a worker thread until the http-request timeout closes the connection. Many such connections can sustain high CPU use and deny service.
What to do: Upgrade HAProxy to 3.4.6.
| Product | Affected | Fixed in |
|---|---|---|
| HAProxy | 3.2 before 3.4.6 | 3.4.6 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.
- Weakness
- CWE-252
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
In the news
2 storiesUbuntu fixes HAProxy regression on 22.04 after security update
The earlier fix for truncated HTTP/2 PING handling could exhaust CPU; the follow-up corrects a chunked-request regression.
38