Ubuntu fixes HAProxy regression on 22.04 after security update
Original title: USN-8972-2: HAProxy regression
The earlier fix for truncated HTTP/2 PING handling could exhaust CPU; the follow-up corrects a chunked-request regression.
Ubuntu published USN-8972-2 after USN-8972-1, which patched HAProxy, caused a regression on Ubuntu 22.04 LTS when processing certain chunked requests. The original issues let a remote attacker drive excessive CPU use and deny service with truncated HTTP/2 PING frames (CVE-2026-110353) or certain HTTP/1.1 chunked requests. The new update fixes the regression.
Unconfirmed: The feed text is truncated and does not give package versions or a second CVE id.
- Regression affects Ubuntu 22.04 LTS after the USN-8972-1 HAProxy update.
- CVE-2026-110353 covers mishandled truncated HTTP/2 PING frames.
- A second issue involves certain HTTP/1.1 chunked requests and CPU exhaustion.
- The notice does not state known exploitation or fixed package versions.
Impact: remote denial of service via excessive CPU use
| Product | Affected |
|---|---|
| Ubuntu HAProxy | Ubuntu 22.04 LTS |
- 1.Install the USN-8972-2 HAProxy update on Ubuntu 22.04 LTS.
- CVEs
- CVE-2026-110353
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-110353 | Unauthenticated DoS in HAProxy via truncated HTTP/2 PING | 7.5 | — |
From the original article
USN-8972-1 fixed vulnerabilities in HAProxy. On Ubuntu 22. 04 LTS, the update caused a regression when processing certain chunked requests.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.