IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
7.5Alta

CVE-2026-55204HAProxy - NULL Pointer Dereference in hpack_dht_insert Function

haproxy haproxy Publicada: (hace 4 meses)

Descripción

HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.

Debilidad (CWE): CWE-476

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
haproxy aloha ≤ 3.4.0
haproxy haproxy ≤ 3.4.0

Referencias y parches

Coincidencias CPE (NVD) (6)
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* < 2.4.36
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* ≥ 2.5 < 2.6.30
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* ≥ 2.7 < 2.8.25
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* ≥ 2.9 < 3.0.24
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* ≥ 3.1 < 3.2.20
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* ≥ 3.3 < 3.4.1

CVE recientes del mismo producto — HAProxy

7.5Alta
CVE-2026-110353
HAProxy HAProxy; HAProxy HAProxy Enterprise Edition; HAProxy Kubernetes Ingress Controller; Haproxy Kubernetes Ingress Controller Enterprise

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handler…

7.5Alta
CVE-2026-110354
HAProxy HAProxy; HAProxy HAProxy Enterprise Edition; HAProxy Technologies HAProxy Kubernetes Ingress Controller; HAProxy Technologies Kubernetes Ingress Controller Enterprise

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeat…

7.5Alta
CVE-2026-90678
HAProxy HAProxy

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend …

3.7Baja
CVE-2026-26080
HAProxy HAProxy

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.

4.8Media
CVE-2026-26081
HAProxy HAProxy

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

7.5Alta
CVE-2026-55203

HAProxy - Integer Overflow in FCGI Demux Record Length Field

haproxy haproxy

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field…