CVE-2026-110353
Last modified
CVE-2026-110353 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. EPSS estimates a 0.68% chance of exploitation in the next 30 days.
Description
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| HAProxy | HAProxy | >= 3.2.0, < 3.2.26; >= 3.3.0, < 3.3.17; >= 3.4.0, < 3.4.6; >= 3.5-dev, < 3.5-dev9 |
| HAProxy | HAProxy Enterprise Edition | >= 3.2.0r1, < 3.2r1-378.1259; >= 3.3.0r1, < 3.3r1-377.1005 |
| HAProxy | Kubernetes Ingress Controller | >= 3.2.0, < 3.2.17 |
| Haproxy | Kubernetes Ingress Controller Enterprise | >= 3.2.0, < 3.2.17-ee1; >= 3.0, < 3.0.16-ee17; >= 1.11, < 1.11.14-ee11 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-110353?
How severe is CVE-2026-110353?
How do I fix CVE-2026-110353?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-11032Inappropriate implementation in Password Manager in Google C…6.5
- CVE-2026-110322The PEAK-System PCAN type 0x4030 processing path fails to va…5.5
- CVE-2026-110324The visibility check of Gitea user profiles was applied to G…6.5
- CVE-2026-11033Uninitialized Use in WebML in Google Chrome on Mac prior to …6.5
- CVE-2026-11034Insufficient validation of untrusted input in Tab Group Sync…6.1
- CVE-2026-11035Inappropriate implementation in Custom Tabs in Google Chrome…7.3
- CVE-2026-110354HAProxy 3 before 3.4.6 allows a remote unauthenticated attac…7.5
- CVE-2026-110359Hyland Desktop Host for Windows before 25.1.1 is vulnerable …7.8
- CVE-2026-11036Inappropriate implementation in DOM in Google Chrome prior t…6.5
- CVE-2026-110360Missing Authorization vulnerability in WPdreams Ajax Search …5.3
- CVE-2026-110361Insertion of Sensitive Information Into Sent Data vulnerabil…6.5
- CVE-2026-110362Missing Authorization vulnerability in Planet studio PlanetS…5.3
Are you affected by CVE-2026-110353?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST