CVE-2026-110353
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.
CVE-2026-110353
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-110353
HAProxy
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
HAProxy Enterprise Edition
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Kubernetes Ingress Controller
Source reference: /containers/cna/affected/2/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Kubernetes Ingress Controller Enterprise
Source reference: /containers/cna/affected/3/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.haproxy.org/git/haproxy.git/",
"vendor": "HAProxy",
"modules": [
"mux-h2"
],
"product": "HAProxy",
"versions": [
{
"status": "affected",
"version": "3.2.0",
"lessThan": "3.2.26",
"versionType": "custom"
},
{
"status": "affected",
"version": "3.3.0",
"lessThan": "3.3.17",
"versionType": "custom"
},
{
"status": "affected",
"version": "3.4.0",
"lessThan": "3.4.6",
"versionType": "custom"
},
{
"status": "affected",
"version": "3.5-dev",
"lessThan": "3.5-dev9",
"versionType": "custom"
}
],
"programFiles": [
"src/mux_h2.c"
],
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "h2c_handle_ping"
}
]
},
{
"vendor": "HAProxy",
"product": "HAProxy Enterprise Edition",
"versions": [
{
"status": "affected",
"version": "3.2.0r1",
"lessThan": "3.2r1-378.1259",
"versionType": "custom"
},
{
"status": "affected",
"version": "3.3.0r1",
"lessThan": "3.3r1-377.1005",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "HAProxy",
"product": "Kubernetes Ingress Controller",
"versions": [
{
"status": "affected",
"version": "3.2.0",
"lessThan": "3.2.17",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Haproxy",
"product": "Kubernetes Ingress Controller Enterprise",
"versions": [
{
"status": "affected",
"version": "3.2.0",
"lessThan": "3.2.17-ee1",
"versionType": "custom"
},
{
"status": "affected",
"version": "3.0",
"lessThan": "3.0.16-ee17",
"versionType": "custom"
},
{
"status": "affected",
"version": "1.11",
"lessThan": "1.11.14-ee11",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-110353
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #52305 · Revision 1
- Added to Heist Feed
- Publisher date