HAProxy Vulnerabilities — Ubuntu Security Update (USN-8972-1)
USN-8972-1 fixes two HAProxy vulnerabilities on Ubuntu: truncated HTTP/2 PING frames causing excessive CPU consumption (CVE-2026-110353, CVSS 7.5) and a second crafted-traffic flaw. Update: sudo apt update && sudo apt upgrade haproxy and restart the service — load balancers are the front door of every site behind them.
SharedLicense लाइसेंस के तहत इसका अर्थ
HAProxy terminates traffic for entire fleets — CPU-exhaustion via cheap PING frames takes down every proxied site with minimal attacker cost, the cheapest DoS multiplier in the stack.
-
USN-8972-1
Publication date
3 November 2026
Overview
HAProxy could be made to crash if it received specially crafted
network traffic.
Releases
Packages
- haproxy – fast and reliable load balancing reverse proxy
Details
It was discovered that HAProxy incorrectly handled truncated HTTP/2
PING frames. A remote attacker could possibly use this issue to cause
HAProxy to consume excessive CPU resources, leading to a denial of
service. (CVE-2026-110353)
It was discovered that HAProxy incorrectly handled certain HTTP/1.1
chunked requests. A remote attacker could possibly use this issue to
cause HAProxy to consume excessive CPU resources, leading to a denial
of service. (CVE-2026-110354)
It was discovered that HAProxy incorrectly handled truncated HTTP/2
PING frames. A remote attacker could possibly use this issue to cause
HAProxy to consume excessive CPU resources, leading to a denial of
service. (CVE-2026-110353)
It was discovered that HAProxy incorrectly handled certain HTTP/1.1
chunked requests. A remote attacker could possibly use this issue to
cause HAProxy to consume excessive CPU resources, leading to a denial
of service. (CVE-2026-110354)
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.
The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
|
26.10
stonking |
haproxy – | ||
|
26.04
LTS resolute |
haproxy – | ||
|
24.04
LTS noble |
haproxy – | ||
|
22.04
LTS jammy |
haproxy – | ||
References
अक्सर पूछे जाने वाले प्रश्न
What is USN-8972-1?
Who is affected?
How do I apply the fix?
Why are HTTP/2 PING frames a DoS vector?
अपने सिस्टम में भेद्यताओं की जाँच करें
अपना उत्पाद और ऑपरेटिंग सिस्टम चुनें ताकि आपके लिए लागू सटीक फिक्स कमांड देख सकें।
अपना सिस्टम जाँचें