CVE-2026-110353

A flaw was found in HAProxy. A remote, unauthenticated attacker can cause a Denial of Service (DoS) by sending a truncated HTTP/2 PING frame. Because the server fails to properly validate and process the incomplete frame, the pending data is never consumed, causing worker threads to spin continuously and exhaust CPU resources. This sustained resource exhaustion can degrade server performance or make the service unresponsive to legitimate users.

This vulnerability is rated as having an Important severity because an unauthenticated remote attacker can cause high CPU exhaustion across worker threads without requiring special privileges or user interaction. When HAProxy operates as a public-facing load balancer or reverse proxy handling untrusted traffic over HTTP/2, repeated malformed frames can monopolize worker capacity until request timeouts terminate the session. Deployments that do not enable HTTP/2 negotiation or that restrict listener access to trusted networks face significantly reduced risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.