Güvenlik Danışarlıklarına Dön

HAProxy Vulnerabilities — Ubuntu Security Update (USN-8972-1)

USN-8972-1 fixes two HAProxy vulnerabilities on Ubuntu: truncated HTTP/2 PING frames causing excessive CPU consumption (CVE-2026-110353, CVSS 7.5) and a second crafted-traffic flaw. Update: sudo apt update && sudo apt upgrade haproxy and restart the service — load balancers are the front door of every site behind them.

High 7.5 CVSS
Ubuntu 20.04 Ubuntu 22.04

SharedLicense lisansı altında bunun anlamı

HAProxy terminates traffic for entire fleets — CPU-exhaustion via cheap PING frames takes down every proxied site with minimal attacker cost, the cheapest DoS multiplier in the stack.

  1. Ubuntu Security Notices

  2. USN-8972-1

Publication date

3 November 2026

Overview

HAProxy could be made to crash if it received specially crafted
network traffic.

Releases


26.10


26.04 LTS


24.04 LTS


22.04 LTS

Packages

  • haproxy – fast and reliable load balancing reverse proxy

Details

It was discovered that HAProxy incorrectly handled truncated HTTP/2
PING frames. A remote attacker could possibly use this issue to cause
HAProxy to consume excessive CPU resources, leading to a denial of
service. (CVE-2026-110353)

It was discovered that HAProxy incorrectly handled certain HTTP/1.1
chunked requests. A remote attacker could possibly use this issue to
cause HAProxy to consume excessive CPU resources, leading to a denial
of service. (CVE-2026-110354)

It was discovered that HAProxy incorrectly handled truncated HTTP/2
PING frames. A remote attacker could possibly use this issue to cause
HAProxy to consume excessive CPU resources, leading to a denial of
service. (CVE-2026-110353)

It was discovered that HAProxy incorrectly handled certain HTTP/1.1
chunked requests. A remote attacker could possibly use this issue to
cause HAProxy to consume excessive CPU resources, leading to a denial
of service. (CVE-2026-110354)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
26.10

stonking

 haproxy – 

3.4.2-1ubuntu4.1
26.04

LTS resolute

 haproxy – 

3.2.25-0ubuntu0.26.04.2
24.04

LTS noble

 haproxy – 

2.8.30-0ubuntu0.24.04.2
22.04

LTS jammy

 haproxy – 

2.4.30-0ubuntu0.22.04.3

References

Sıkça Sorulan Sorular

What is USN-8972-1?
It is Ubuntu's HAProxy security notice fixing two CVEs: CVE-2026-110353 (truncated HTTP/2 PING frames driving excessive CPU consumption) and a second crafted-traffic flaw — aggregate CVSS 7.5.
Who is affected?
Ubuntu servers running HAProxy as a load balancer or gateway — the flaw is reachable by anyone who can open an HTTP/2 connection to it, which on a load balancer is the public internet.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade haproxy and restart the haproxy service; verify the version afterwards. Balance the restart across failover nodes to avoid downtime.
Why are HTTP/2 PING frames a DoS vector?
PING frames demand processing and a response regardless of connection state — truncated or malformed versions force expensive error handling per frame, so cheap traffic creates disproportionate CPU load.

Referanslar

Güvenlik Danışarlıkları

İlgili Danışarlıklar

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

2026-11-11

Sisteminizi güvenlik açıkları açısından kontrol edin

Size uygun tam düzeltme komutlarını görmek için ürününüzü ve işletim sisteminizi seçin.

Sisteminizi Kontrol Edin