Vulnpedia
← Search CVEs

CVE-2026-110353

HIGH 7.5

Published 2026-10-22 · Last modified 2026-10-22

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.

ELEVATED IMPACT

Severe if exploited (CVSS 7.5), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.7%chance of exploitation in 30 days · 54th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

7.5CVSS 3.1 · HIGH

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Haproxy

Products Haproxy Haproxy Enterprise Edition Kubernetes Ingress Controller Kubernetes Ingress Controller Enterprise

Weakness (CWE)

  • CWE-252: Unchecked Return Value

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References and research data (JSON)

Vendor product assessments

  • haproxy-0:3.0.30-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-110353 · Updated 2026-10-22T19:32:03+00:00
  • haproxy-0:3.0.30-0.1.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-110353 · Updated 2026-10-22T19:32:03+00:00
  • haproxy-0:3.0.30-0.1.hum1@src as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-110353 · Updated 2026-10-22T19:32:03+00:00
  • haproxy-0:3.0.30-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-110353 · Updated 2026-10-22T19:32:03+00:00
  • haproxy.src as a component of Red Hat Ceph Storage 5 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/haproxy?arch=src

    • none available: Fix deferred
    Red Hat · CVE-2026-110353 · Updated 2026-10-22T19:32:03+00:00
  • haproxy22 as a component of Red Hat Ceph Storage 5 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/haproxy22

    • none available: Fix deferred
    Red Hat · CVE-2026-110353 · Updated 2026-10-22T19:32:03+00:00
  • haproxy as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/haproxy

    • none available: Affected
    Red Hat · CVE-2026-110353 · Updated 2026-10-22T19:32:03+00:00
  • haproxy.src as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/haproxy?arch=src

    • none available: Affected
    Red Hat · CVE-2026-110353 · Updated 2026-10-22T19:32:03+00:00
  • haproxy as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/haproxy

    • none available: Affected
    Red Hat · CVE-2026-110353 · Updated 2026-10-22T19:32:03+00:00
  • haproxy.src as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/haproxy?arch=src

    • none available: Affected
    Red Hat · CVE-2026-110353 · Updated 2026-10-22T19:32:03+00:00
  • haproxy as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/haproxy

    • none available: Affected
    Red Hat · CVE-2026-110353 · Updated 2026-10-22T19:32:03+00:00
  • haproxy.src as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/haproxy?arch=src

    • none available: Affected
    Red Hat · CVE-2026-110353 · Updated 2026-10-22T19:32:03+00:00
  • haproxy as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/haproxy

    • none available: Affected
    Red Hat · CVE-2026-110353 · Updated 2026-10-22T19:32:03+00:00
  • haproxy.src as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/haproxy?arch=src

    • none available: Affected
    Red Hat · CVE-2026-110353 · Updated 2026-10-22T19:32:03+00:00
  • haproxy.src as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/haproxy?arch=src

    • none available: Affected
    Red Hat · CVE-2026-110353 · Updated 2026-10-22T19:32:03+00:00
  • haproxy18 as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/haproxy18

    • none available: Affected
    Red Hat · CVE-2026-110353 · Updated 2026-10-22T19:32:03+00:00
  • haproxy20 as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/haproxy20

    • none available: Affected
    Red Hat · CVE-2026-110353 · Updated 2026-10-22T19:32:03+00:00
  • haproxy22 as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/haproxy22

    • none available: Affected
    Red Hat · CVE-2026-110353 · Updated 2026-10-22T19:32:03+00:00
  • haproxy26 as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/haproxy26

    • none available: Affected
    Red Hat · CVE-2026-110353 · Updated 2026-10-22T19:32:03+00:00
  • haproxy28 as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/haproxy28

    • none available: Affected
    Red Hat · CVE-2026-110353 · Updated 2026-10-22T19:32:03+00:00

All CVSS metrics

  • HIGH 7.5 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • HIGH 7.5 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS