CVEs / CVE-2026-110353
CVE-2026-110353: HAProxy HAProxy vulnerability
- high 7.5 CVSS 3.1 (from the CNA)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2026-110353
Description
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| HAProxy HAProxy | from 3.2.0, before 3.2.26 | 3.2.26 |
| HAProxy HAProxy | from 3.3.0, before 3.3.17 | 3.3.17 |
| HAProxy HAProxy | from 3.4.0, before 3.4.6 | 3.4.6 |
| HAProxy HAProxy | from 3.5-dev, before 3.5-dev9 | 3.5-dev9 |
| HAProxy HAProxy Enterprise Edition | from 3.2.0r1, before 3.2r1-378.1259 | 3.2r1-378.1259 |
| HAProxy HAProxy Enterprise Edition | from 3.3.0r1, before 3.3r1-377.1005 | 3.3r1-377.1005 |
| HAProxy Kubernetes Ingress Controller | from 3.2.0, before 3.2.17 | 3.2.17 |
| Haproxy Kubernetes Ingress Controller Enterprise | from 3.2.0, before 3.2.17-ee1 | 3.2.17-ee1 |
| Haproxy Kubernetes Ingress Controller Enterprise | from 3.0, before 3.0.16-ee17 | 3.0.16-ee17 |
| Haproxy Kubernetes Ingress Controller Enterprise | from 1.11, before 1.11.14-ee11 | 1.11.14-ee11 |
Exploitation
Not in the CISA Known Exploited Vulnerabilities catalog as of 4 Nov 2026.
Severity
| CVSS 3.1 | 7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HScored by the CNA ([email protected]) |
|---|---|
| Weakness | CWE-252 |
On the Stackurity blog
References
- CVE-2026-110353 on NVD
- CVE-2026-110353 on OSV
- https://git.haproxy.org/?p=haproxy.git;a=commit;h=cec63e95f62a7412484f1134f5aa227e5b7e1466
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.