Executive Summary

CVE-2026-55204 is a high-severity vulnerability in HAProxy versions up to 3.4.0 involving a null pointer dereference in the hpack_dht_insert() function within src/hpack-tbl.c.

The vulnerability occurs because the function fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. Specifically, under memory pressure, an attacker can trigger HPACK dynamic table insertions that cause hpack_dht_defrag() to return NULL, which is then dereferenced without a proper check.

This leads to a crash of HAProxy worker processes due to a segmentation fault, resulting in a denial of service condition.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause HAProxy worker processes to crash unexpectedly when exploited, leading to denial of service.

An attacker can exploit this by triggering HPACK dynamic table insertions under memory pressure, causing the service to become unavailable.

• Service disruption due to HAProxy worker process crashes.
• Potential downtime or degraded performance of applications relying on HAProxy for load balancing or proxying.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a NULL pointer dereference in HAProxy versions up to 3.4.0 triggered by HPACK dynamic table insertions under memory pressure, causing worker process crashes and denial of service.

Detection can focus on monitoring HAProxy worker process crashes or segmentation faults (SIGSEGV) related to HPACK table handling.

Suggested commands include checking HAProxy logs for crash reports or segmentation faults and using system tools to monitor HAProxy process stability.

• Check HAProxy logs for worker crashes: `grep -i 'segfault' /var/log/haproxy.log` or relevant log files.
• Use systemd journal to find HAProxy crashes: `journalctl -u haproxy | grep -i 'segfault'`.
• Monitor HAProxy worker processes for unexpected exits or restarts: `ps aux | grep haproxy` and `systemctl status haproxy`.
• Enable core dumps for HAProxy to analyze crashes: `ulimit -c unlimited` before starting HAProxy.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade HAProxy to a version that includes the fix from commit 9a6d1fe, which adds a NULL check after the hpack_dht_defrag() call to prevent the NULL pointer dereference.

If upgrading immediately is not possible, consider limiting or controlling HPACK dynamic table insertions or memory pressure on HAProxy to reduce the chance of triggering the vulnerability.

Additionally, monitor HAProxy worker processes for crashes and restart them promptly to maintain service availability.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0