CVE-2026-110353: HAProxy 3.2.0 to before 3.2.26, 3.3.0 to before 3.3.17, 3.4.0 to before 3.4.6, 3.5-dev to before 3.5-dev9; +3 more…

Affected technology

HAProxy · 3.2.0 to before 3.2.26, 3.3.0 to before 3.3.17, 3.4.0 to before 3.4.6, 3.5-dev to before 3.5-dev9
HAProxy

HAProxy Enterprise Edition · 3.2.0r1 to before 3.2r1-378.1259, 3.3.0r1 to before 3.3r1-377.1005
HAProxy

Kubernetes Ingress Controller · 3.2.0 to before 3.2.17
HAProxy

Kubernetes Ingress Controller Enterprise · 3.2.0 to before 3.2.17-ee1, 3.0 to before 3.0.16-ee17, 1.11 to before 1.11.14-ee11
Haproxy

Description’s affected range: before 3.4.6

Component: mux-h2
Function: h2c_handle_ping
File: src/mux_h2.c

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

A remote unauthenticated attacker can cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Vendor/CNA’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality and integrity impact as none; availability impact as high.