Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-110353 Overview
CVE-2026-110353 is a denial of service vulnerability in HAProxy, a widely deployed open-source load balancer and reverse proxy. The flaw affects HAProxy versions 3.2 through 3.4.5 and is fixed in version 3.4.6. A remote unauthenticated attacker can exhaust worker-thread CPU resources by sending truncated HTTP/2 PING frames. The h2c_handle_ping function in src/mux_h2.c fails to check for a short read, causing the H2 multiplexer tasklet to spin until the HTTP request timeout fires. Attackers who open many such connections can sustain high CPU usage across HAProxy workers.
Critical Impact
Unauthenticated remote attackers can trigger sustained CPU exhaustion on HAProxy worker threads, degrading or disabling proxied services.
Affected Products
- HAProxy 3.2.x through 3.4.5
- HAProxy 3.3.x branch (prior to fixed releases)
- Deployments exposing HTTP/2 listeners to untrusted networks
Discovery Timeline
- 2026-10-22 - CVE-2026-110353 published to NVD
- 2026-10-22 - Last updated in NVD database
Technical Details for CVE-2026-110353
Vulnerability Analysis
The vulnerability is a CPU exhaustion denial of service caused by an unchecked return value [CWE-252] in HAProxy's HTTP/2 multiplexer. HAProxy processes HTTP/2 frames through dedicated handlers in src/mux_h2.c. Most handlers verify that the full frame payload is available before processing. The h2c_handle_ping function omits this short-read check.
When a truncated PING frame arrives, the handler cannot complete processing and does not consume the pending data from the receive buffer. The H2 multiplexer tasklet is then rescheduled repeatedly because unread data remains queued. The worker thread spins on the same incomplete frame without progress until the timeout http-request setting closes the connection.
Root Cause
The root cause is a missing boundary check in h2c_handle_ping. Unlike peer handlers for other H2 frame types, the function does not validate that the frame payload length matches the data available in the buffer. The incomplete frame is neither processed nor discarded, leaving the connection in a tight wake loop driven by the pending data signal.
Attack Vector
Exploitation requires only network access to an HAProxy listener accepting HTTP/2 traffic. No authentication or user interaction is required. An attacker establishes an HTTP/2 session, sends a PING frame with a header indicating a payload but truncates the actual payload bytes, then holds the connection open. The worker tasklet spins on the connection, consuming CPU until timeout http-request elapses. Opening many parallel connections multiplies the CPU drain and can saturate all worker threads. Technical details are available in the HAProxy Commit Change.
Detection Methods for CVE-2026-110353
Indicators of Compromise
- Sustained high CPU utilization on HAProxy worker threads without a corresponding increase in completed requests
- Elevated counts of HTTP/2 connections closed with timeout http-request in HAProxy logs
- Repeated short-lived HTTP/2 sessions from a limited set of source IP addresses sending PING frames
Detection Strategies
- Monitor HAProxy show stat and show info output for abnormal CurrConns and per-thread CPU usage divergence
- Inspect HTTP/2 traffic for PING frames whose declared length exceeds the delivered payload at the TCP layer
- Alert on sharp increases in connections terminated by http-request timeouts on HTTP/2 frontends
Monitoring Recommendations
- Enable HAProxy runtime statistics and export worker CPU metrics to a time-series backend
- Capture packet samples on HTTP/2 listeners to validate frame length consistency during anomalies
- Correlate frontend connection rate with backend request completion rate to identify stalled workers
How to Mitigate CVE-2026-110353
Immediate Actions Required
- Upgrade HAProxy to version 3.4.6 or later, which adds the missing short-read check in h2c_handle_ping
- Restrict HTTP/2 listener exposure to trusted networks where upgrade is not immediately possible
- Reduce timeout http-request to shorten the window during which a stalled connection can consume CPU
Patch Information
The fix is published in the upstream HAProxy repository and corrects h2c_handle_ping in src/mux_h2.c to validate payload availability before processing. Review the patch in the HAProxy Commit Change and apply vendor-provided packages for your distribution.
Workarounds
- Disable HTTP/2 on affected frontends by removing the alpn h2 or proto h2 directives until patched
- Rate-limit new HTTP/2 connections per source IP using stick-table and tcp-request connection reject rules
- Place an upstream proxy or WAF that validates HTTP/2 frame integrity in front of HAProxy
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
