Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| HAProxy | HAProxy | unaffected |
|
|||||||||||||||
| HAProxy | HAProxy Enterprise Edition | unaffected |
|
|||||||||||||||
| HAProxy | Kubernetes Ingress Controller | unaffected |
|
|||||||||||||||
| Haproxy | Kubernetes Ingress Controller Enterprise | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 22 Oct 2026 03:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage. | |
| Weaknesses | CWE-252 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2026-10-22T02:53:33.198Z
Reserved: 2026-10-13T23:18:04.062Z
Link: CVE-2026-110353
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-22T03:16:31.270
Modified: 2026-10-22T03:16:31.270
Link: CVE-2026-110353
Redhat
No data.
OpenCVE Enrichment
No data.