high CVSS 7.5 EPSS 0.68%

CVE-2026-110353·HAProxy vulnerability

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.

Severity
high
Software
HAProxy
Fixed in
3.4.6
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.68% — higher than 52% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-110353 scores 7.5 on CVSS, so a successful attack would be serious — but at 0.68%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

Until: 3.2.26-1

Fixed in: 3.4.6

How to fix this CVE

Upgrade HAProxy to version 3.4.6 or later to patch a denial-of-service vulnerability in HTTP/2 PING frame handling. Systems running HAProxy 3.2 through 3.4.5 should prioritize this update, as the vulnerability allows remote attackers to exhaust worker thread CPU resources without authentication. Apply the patch during a maintenance window and validate load balancer functionality post-deployment.

sudo dnf update haproxy

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

Multiple incomplete HTTP/2 PING frames (frame type 0x06) with payload length less than 8 bytes arriving from different source IPs; look for patterns in HAProxy debug logs showing 'h2c_handle_ping' errors or repeated tasklet wake-ups without frame consumption

How to check if you are affected

  1. Step 1: Check installed HAProxy version with 'haproxy -v' and compare against 3.4.6
  2. Step 2: Verify HTTP/2 (h2c) is enabled in your HAProxy configuration by searching for 'proto h2' or 'alpn h2' in /etc/haproxy/haproxy.cfg
  3. Step 3: Monitor system logs and HAProxy stats for sustained high CPU usage on worker processes correlating with incomplete HTTP/2 connections using 'watch -n 1 "ps aux | grep haproxy"'
  4. Step 4: After patching, confirm the new version with 'haproxy -v' and validate that h2c_handle_ping frame processing no longer causes CPU spin by checking worker CPU utilization under normal load

FAQ

What is CVE-2026-110353?

This vulnerability exists in HAProxy's HTTP/2 protocol handler, where malformed PING frames with truncated payloads trigger a CPU exhaustion condition. The multiplexer repeatedly attempts to process incomplete frame data without properly consuming it, causing worker threads to spin until the connection times out.

Is CVE-2026-110353 being actively exploited?

No, this CVE is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits are available, though the attack is trivial to execute with basic HTTP/2 tooling.

What versions of HAProxy are affected by CVE-2026-110353?

HAProxy versions 3.2 through 3.4.5 are vulnerable. Version 3.4.6 and later include the patch that adds proper bounds checking in the h2c_handle_ping function.

How do I check if my server is vulnerable to CVE-2026-110353?

Run 'haproxy -v' to determine your version. If you're running 3.2 or any 3.4.x version before 3.4.6, you are vulnerable. Cross-reference with your configuration to confirm HTTP/2 support is active.

Does Defensia detect CVE-2026-110353?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If HAProxy is installed on a monitored server, CVE-2026-110353 will appear in your dashboard with remediation steps.

Related HAProxy CVEs

CVE-2026-55203CVSS 7.5HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.
CVE-2026-55204CVSS 7.5HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.
CVE-2026-110354CVSS 7.5HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
CVE-2026-26081CVSS 4.8HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-110353. Free for 1 server.

Get started free