CVE-2026-110353

State: Published
Severity: 7.5 High
Published: Oct 22, 2026
Updated: Oct 22, 2026
Reserved: Oct 13, 2026

Description

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	mitre

Weaknesses

CWE-252 Unchecked Return Value

Affected Products

Product	Versions
HAProxyHAProxy	3.2.0 to before 3.2.26Affected 3.3.0 to before 3.3.17Affected 3.4.0 to before 3.4.6Affected 3.5-dev to before 3.5-dev9Affected
HAProxy Enterprise EditionHAProxy	3.2.0r1 to before 3.2r1-378.1259Affected 3.3.0r1 to before 3.3r1-377.1005Affected
Kubernetes Ingress ControllerHAProxy	3.2.0 to before 3.2.17Affected
Kubernetes Ingress Controller EnterpriseHaproxy	3.2.0 to before 3.2.17-ee1Affected 3.0 to before 3.0.16-ee17Affected 1.11 to before 1.11.14-ee11Affected

References

https://git.haproxy.org/?p=haproxy.git;a=commit;h=cec63e95f62a7412484f1134f5aa227e5b7e1466vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.