Multiple security vulnerabilities have been identified in HAProxy, a load balancing reverse proxy, on affected releases 26.10, 26.04 LTS, 24.04 LTS, and 22.04 LTS. The affected component is the network traffic processing path, where specially crafted traffic can cause excessive CPU consumption. The overall risk is denial of service, because a remote attacker can exhaust resources and make the proxy unavailable.
CVE-2026-110353: HAProxy incorrectly handled truncated HTTP/2 PING frames. A remote attacker could possibly use this issue to cause excessive CPU resource consumption, leading to denial of service.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in HAProxy, a load balancing reverse proxy, on affected releases 26.10, 26.04 LTS, 24.04 LTS, and 22.04 LTS. The affected component is the network traffic processing path, where specially crafted traffic can cause excessive CPU consumption. The overall risk is denial of service, because a remote attacker can exhaust resources and make the proxy unavailable.
CVE-2026-110353: HAProxy incorrectly handled truncated HTTP/2 PING frames. A remote attacker could possibly use this issue to cause excessive CPU resource consumption, leading to denial of service.[emaillocker id="1283"]
CVE-2026-110354: HAProxy incorrectly handled certain HTTP/1.1 chunked requests. A remote attacker could possibly use this issue to cause excessive CPU resource consumption, leading to denial of service.
These vulnerabilities collectively present a denial-of-service risk for systems that expose HAProxy to untrusted network traffic. Organizations running HAProxy as a load balancer or reverse proxy are most at risk, particularly when processing traffic from external clients. The general action is to prioritize availability protection for exposed proxy services.
We recommend you to update HAProxy to version 3.4.2-1ubuntu4.1, 3.2.25-0ubuntu0.26.04.2, 2.8.30-0ubuntu0.24.04.2, or 2.4.30-0ubuntu0.22.04.3 depending on your installed Ubuntu release.
The following reports contain further technical details:
[/emaillocker]