high CVSS 7.5 EPSS 0.48%

CVE-2026-55204·HAProxy vulnerability

HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.

Severity
high
Software
HAProxy
Fixed in
3.4.1
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.48% — higher than 40% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-55204 scores 7.5 on CVSS, so a successful attack would be serious — but at 0.48%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

From: 3.3

Until: 3.4.1

Fixed in: 3.4.1

How to fix this CVE

Upgrade HAProxy to version 3.4.1 or later to patch a null pointer dereference flaw in the HPACK dynamic table handling code. This vulnerability can be triggered when the memory pool becomes exhausted during HTTP/2 header compression operations, leading to worker process crashes. Verify the update is applied and restart HAProxy services to restore stability.

sudo dnf update haproxy

Defensia detects this vulnerability

How to check if you are affected

  1. Run 'haproxy -v' or 'dpkg -l | grep haproxy' (Debian/Ubuntu) / 'rpm -qa | grep haproxy' (RHEL/CentOS) to confirm the installed version is 3.3.x through 3.4.0
  2. Check if HTTP/2 support is enabled in HAProxy configuration: grep -i 'h2' /etc/haproxy/haproxy.cfg or similar config paths
  3. Monitor HAProxy error logs for segmentation faults or null pointer dereference crashes: grep -i 'segfault\|null pointer\|core dumped' /var/log/haproxy.log
  4. Verify the fix by upgrading to 3.4.1+ and confirming via 'haproxy -v' that the version string no longer matches 3.3.x or 3.4.0

FAQ

What is CVE-2026-55204?

CVE-2026-55204 is a denial of service vulnerability in HAProxy where improper error handling in the HPACK dynamic table insertion function allows a NULL pointer dereference when memory is constrained, causing worker process crashes during HTTP/2 operations.

Is CVE-2026-55204 being actively exploited?

No, this vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits are currently available.

What versions of HAProxy are affected by CVE-2026-55204?

HAProxy versions 3.3.0 through 3.4.0 are vulnerable; version 3.4.1 and later include the patch.

How do I check if my server is vulnerable to CVE-2026-55204?

Run 'haproxy -v' and check if the output shows version 3.3.x or 3.4.0. If HTTP/2 is enabled in your configuration ('grep h2 /etc/haproxy/haproxy.cfg') and you are on an affected version, your deployment is at risk.

Does Defensia detect CVE-2026-55204?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If HAProxy is installed on a monitored server, CVE-2026-55204 will appear in your dashboard with remediation steps.

Related HAProxy CVEs

CVE-2026-55203CVSS 7.5HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.
CVE-2026-110353CVSS 7.5HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.
CVE-2026-110354CVSS 7.5HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
CVE-2026-26081CVSS 4.8HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-55204. Free for 1 server.

Get started free