CVE-2026-110353
Received Received - Intake

Denial of Service in HAProxy via Truncated HTTP/2 PING Frame

Publication date: 2026-10-22

Last updated on: 2026-10-22

Assigner: MITRE

Description
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-22
Last Modified
2026-10-22
Generated
2026-10-22
AI Q&A
2026-10-22
EPSS Evaluated
N/A
NVD
CVE-2026-110353
EUVD
EUVD-2026-108001

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
HAProxy HAProxy 3.2.0
HAProxy HAProxy 3.3.0
HAProxy HAProxy 3.4.0
HAProxy HAProxy 3.5-dev
HAProxy HAProxy Enterprise Edition 3.2.0r1
HAProxy HAProxy Enterprise Edition 3.3.0r1
HAProxy Kubernetes Ingress Controller 3.2.0
Haproxy Kubernetes Ingress Controller Enterprise 3.2.0
Haproxy Kubernetes Ingress Controller Enterprise 3.0
Haproxy Kubernetes Ingress Controller Enterprise 1.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-252 The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in HAProxy 3.2 before 3.4.6 allows a remote attacker to cause a denial of service by sending a truncated HTTP/2 PING frame. The issue occurs because the h2c_handle_ping function does not check for incomplete data, causing the CPU to spin in an infinite loop while processing the malformed frame. This leads to high CPU usage and service disruption.

Detection Guidance

This vulnerability can be detected by monitoring HAProxy logs for truncated HTTP/2 PING frames or unusual CPU spikes. Check HAProxy logs for errors related to h2c_handle_ping or frame processing failures. Use system monitoring tools like top or htop to observe CPU usage patterns during network traffic.

Impact Analysis

This vulnerability can cause your HAProxy server to experience high CPU usage, leading to degraded performance or complete service outages. Attackers can exploit it by sending specially crafted requests, potentially making your system unresponsive for legitimate users.

Mitigation Strategies

Upgrade HAProxy to version 3.4.6 or later to address the issue. If upgrading is not immediately possible, consider disabling HTTP/2 support in HAProxy or applying network-level mitigations such as rate limiting or firewall rules to block malformed PING frames.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110353. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart