Every CVE Search/ Get API key

CVE-2026-55204

HAProxy - NULL Pointer Dereference in hpack_dht_insert Function

8.7 HighFix available

HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.48%Up 0.1 points since Jun 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

HAProxy - NULL Pointer Dereference in hpack_dht_insert Function

HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.

Record
CVE-2026-55204
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
EUVDEUVD-2026-37906 8.7

HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.

Record
EUVD-2026-37906
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-4vj2-5mvx-3vcc 8.7

HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference...

HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.

Record
GHSA-4vj2-5mvx-3vcc
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
NVD 8.7

HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.

Record
CVE-2026-55204
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSV 8.7

HAProxy - NULL Pointer Dereference in hpack_dht_insert Function

HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.

Record
CVE-2026-55204
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-476
Updated
2026-11-04
OSVDEBIAN-CVE-2026-55204 8.7

HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.

Record
DEBIAN-CVE-2026-55204
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 39 moreShow less
OSVOESA-2026-2794 7.5

haproxy security update

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.(CVE-2026-55203)

HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.(CVE-2026-55204)

Record
OESA-2026-2794
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:35453 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:35453
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:55679 7.5

Red Hat Security Advisory: haproxy security update

Record
RHSA-2026:55679
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:55772 7.5

Red Hat Security Advisory: haproxy security update

Record
RHSA-2026:55772
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:55800 7.5

Red Hat Security Advisory: haproxy security update

Record
RHSA-2026:55800
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:55801 7.5

Red Hat Security Advisory: haproxy security update

Record
RHSA-2026:55801
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:55802 7.5

Red Hat Security Advisory: haproxy security update

Record
RHSA-2026:55802
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:55803 7.5

Red Hat Security Advisory: haproxy security update

Record
RHSA-2026:55803
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:55859 7.5

Red Hat Security Advisory: haproxy security update

Record
RHSA-2026:55859
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:55860 7.5

Red Hat Security Advisory: haproxy security update

Record
RHSA-2026:55860
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:55861 7.5

Red Hat Security Advisory: haproxy security update

Record
RHSA-2026:55861
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:55862 7.5

Red Hat Security Advisory: haproxy security update

Record
RHSA-2026:55862
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:55679 7.5

Important: haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

  • haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)

  • haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:55679
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:55772 7.5

Important: haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

  • haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)

  • haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:55772
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:55859 7.5

Important: haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

  • haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:55859
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-55204 8.7

HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.

Record
UBUNTU-CVE-2026-55204
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:55679 No score

Important: haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

  • haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)
  • haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:55679
Updated
2026-11-02
OSVALSA-2026:55772 No score

Important: haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

  • haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)
  • haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:55772
Updated
2026-11-02
OSVALSA-2026:55859 No score

Important: haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

  • haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:55859
Updated
2026-11-02
OSVAZL-90261 No score

CVE-2026-55204 affecting package haproxy for versions less than 2.9.11-7

HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.

Record
AZL-90261
Updated
2026-11-05
OSVBIT-haproxy-2026-55204 No score

HAProxy - NULL Pointer Dereference in hpack_dht_insert Function

HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.

Record
BIT-haproxy-2026-55204
Updated
2026-11-02
OSVCLSA-2026-1782820521 No score

haproxy: Fix of CVE-2026-55204

  • CVE-2026-55204: fix NULL pointer dereference in hpack_dht_insert() when the HPACK dynamic table memory pool is exhausted, which could crash the worker process (denial of service)
Record
CLSA-2026-1782820521
Updated
2026-11-02
OSVCLSA-2026-1782825341 No score

haproxy: Fix of CVE-2026-55204

  • CVE-2026-55204: fix NULL pointer dereference in hpack_dht_insert() when the HPACK dynamic table memory pool is exhausted, which could crash the worker process (denial of service)
Record
CLSA-2026-1782825341
Updated
2026-11-02
OSVCLSA-2026-1782825734 No score

haproxy: Fix of CVE-2026-55204

  • CVE-2026-55204: fix NULL pointer dereference in hpack_dht_insert() when the HPACK dynamic table memory pool is exhausted, which could crash the worker process (denial of service)
Record
CLSA-2026-1782825734
Updated
2026-11-02
OSVCLSA-2026-1782825982 No score

haproxy: Fix of CVE-2026-55204

  • CVE-2026-55204: fix NULL pointer dereference in hpack_dht_insert() when the HPACK dynamic table memory pool is exhausted, which could crash the worker process (denial of service)
Record
CLSA-2026-1782825982
Updated
2026-11-02
OSVCLSA-2026-1782895938 No score

Fix CVE(s): CVE-2026-55204

  • SECURITY UPDATE: NULL pointer dereference in HPACK dynamic table insertion
    • debian/patches/CVE-2026-55204.patch: add missing NULL check after hpack_dht_defrag() in hpack_dht_insert() in src/hpack-tbl.c
    • CVE-2026-55204
Record
CLSA-2026-1782895938
Updated
2026-11-02
OSVCLSA-2026-1782896085 No score

Fix CVE(s): CVE-2026-55204

  • SECURITY UPDATE: NULL pointer dereference in HPACK dynamic table insertion
    • debian/patches/CVE-2026-55204.patch: add a missing NULL check after hpack_dht_defrag() at the third call site in hpack_dht_insert() in src/hpack-tbl.c, preventing a worker process crash via NULL dereference when the HPACK table memory pool is exhausted
    • CVE-2026-55204
Record
CLSA-2026-1782896085
Updated
2026-11-02
OSVCLSA-2026-1783527210 No score

haproxy: Fix of CVE-2026-55204

  • CVE-2026-55204: fix NULL pointer dereference in hpack_dht_insert() by adding a missing NULL check after hpack_dht_defrag() on the data-space defragmentation path, preventing worker SIGSEGV when the HPACK dynamic-table memory pool is exhausted
Record
CLSA-2026-1783527210
Updated
2026-11-02
OSVCLSA-2026-1784545904 No score

Fix CVE(s): CVE-2026-55204

  • SECURITY UPDATE: NULL pointer dereference in the HPACK decoder leading to a worker crash (denial of service)
    • debian/patches/CVE-2026-55204.patch: add missing NULL check after hpack_dht_defrag() in hpack_dht_insert() when the HPACK dynamic table memory pool is exhausted
    • CVE-2026-55204
Record
CLSA-2026-1784545904
Updated
2026-11-02
OSVMGASA-2026-0250 No score

Updated haproxy packages fix security vulnerability

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues. (CVE-2026-55203) HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service. (CVE-2026-55204)

Record
MGASA-2026-0250
Updated
2026-11-02
OSVopenSUSE-SU-2026:11090-1 No score

haproxy-3.4.0+git31.fc300e9f2-1.1 on GA media

These are all security issues fixed in the haproxy-3.4.0+git31.fc300e9f2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11090-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21245-1 No score

Security update for haproxy

This update for haproxy fixes the following issues

  • Update to version 3.2.21+git0.dbe43be37
  • CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).
  • CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).
Record
openSUSE-SU-2026:21245-1
Updated
2026-11-02
OSVSUSE-SU-2026:22515-1 No score

Security update for haproxy

This update for haproxy fixes the following issues

  • CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).
  • CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).
Record
SUSE-SU-2026:22515-1
Updated
2026-11-02
OSVSUSE-SU-2026:22544-1 No score

Security update for haproxy

This update for haproxy fixes the following issues

  • Update to version 3.2.21+git0.dbe43be37
  • CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).
  • CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).
Record
SUSE-SU-2026:22544-1
Updated
2026-11-02
OSVSUSE-SU-2026:22557-1 No score

Security update for haproxy

This update for haproxy fixes the following issues

  • Update to version 3.2.21+git0.dbe43be37
  • CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).
  • CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).
Record
SUSE-SU-2026:22557-1
Updated
2026-11-02
OSVSUSE-SU-2026:22587-1 No score

Security update for haproxy

This update for haproxy fixes the following issues

  • Update to version 3.2.21+git0.dbe43be37
  • CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).
  • CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).
Record
SUSE-SU-2026:22587-1
Updated
2026-11-02
OSVSUSE-SU-2026:22663-1 No score

Security update for haproxy

This update for haproxy fixes the following issues

  • CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).
  • CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).
Record
SUSE-SU-2026:22663-1
Updated
2026-11-02
OSVSUSE-SU-2026:2651-1 No score

Security update for haproxy

This update for haproxy fixes the following issues

  • CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).
  • CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).
Record
SUSE-SU-2026:2651-1
Updated
2026-11-02
OSVSUSE-SU-2026:2652-1 No score

Security update for haproxy

This update for haproxy fixes the following issues

  • CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).
  • CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).
Record
SUSE-SU-2026:2652-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
haproxy
AlmaLinux:10
From an advisory covering 2 CVEs
 before 3.0.5-6.el10_2.2
3.0.5-6.el10_2.2
haproxy
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2.8.14-3.el9_8.2
2.8.14-3.el9_8.2
haproxy
AlmaLinux:8
 before 1.8.27-5.el8_10.2
1.8.27-5.el8_10.2
haproxy
Azure Linux:3
 before 2.9.11-7
2.9.11-7
haproxy
Bitnami
 before 2.4.36, 2.5.0 up to 2.6.30, 2.7.0 up to 2.8.25, 2.9.0 up to 3.0.24, 3.1.0 up to 3.2.20, 3.3.0 up to 3.4.1
2.4.362.6.302.8.253.0.243.2.203.4.1
haproxy
TuxCare:AlmaLinux:9.6
 before 2.4.22-4.el9.tuxcare.els3
2.4.22-4.el9.tuxcare.els3
haproxy
TuxCare:CentOS-Stream:8
 before 1.8.27-5.el8.tuxcare.els2
1.8.27-5.el8.tuxcare.els2
haproxy
TuxCare:CentOS:8.5
 before 1.8.27-2.el8.tuxcare.els2
1.8.27-2.el8.tuxcare.els2
haproxy
TuxCare:CentOS:8.4
 before 1.8.27-2.el8.tuxcare.els2
1.8.27-2.el8.tuxcare.els2
haproxy
TuxCare:Debian:10
 before 1.8.19-1+deb10u5+tuxcare.els1
1.8.19-1+deb10u5+tuxcare.els1
Show 82 moreShow less
Affected packages
PackageAffectedFixed
haproxy-doc
TuxCare:Debian:10
 before 1.8.19-1+deb10u5+tuxcare.els1
1.8.19-1+deb10u5+tuxcare.els1
vim-haproxy
TuxCare:Debian:10
 before 1.8.19-1+deb10u5+tuxcare.els1
1.8.19-1+deb10u5+tuxcare.els1
haproxy
TuxCare:Ubuntu:20.04
 before 2.0.33-0ubuntu0.1+tuxcare.els1
2.0.33-0ubuntu0.1+tuxcare.els1
haproxy-doc
TuxCare:Ubuntu:20.04
 before 2.0.33-0ubuntu0.1+tuxcare.els1
2.0.33-0ubuntu0.1+tuxcare.els1
vim-haproxy
TuxCare:Ubuntu:20.04
 before 2.0.33-0ubuntu0.1+tuxcare.els1
2.0.33-0ubuntu0.1+tuxcare.els1
haproxy
TuxCare:AlmaLinux:9.2
 before 2.4.17-6.el9.tuxcare.els6
2.4.17-6.el9.tuxcare.els6
haproxy
TuxCare:Ubuntu:18.04
 before 1.8.8-1ubuntu0.13.tuxcare.els3
1.8.8-1ubuntu0.13.tuxcare.els3
haproxy-doc
TuxCare:Ubuntu:18.04
 before 1.8.8-1ubuntu0.13.tuxcare.els3
1.8.8-1ubuntu0.13.tuxcare.els3
vim-haproxy
TuxCare:Ubuntu:18.04
 before 1.8.8-1ubuntu0.13.tuxcare.els3
1.8.8-1ubuntu0.13.tuxcare.els3
haproxy
Debian:12
 All versions, plus listed versions
2.6.12-12.6.12-1+deb12u12.6.12-1+deb12u22.6.12-1+deb12u32.6.12-1+deb12u4
Show 45 moreShow less
2.6.13-12.6.14-12.6.15-12.7.0-12.7.1-12.7.2-12.7.2-22.7.3-12.7.4-12.7.5-12.7.6-12.7.7-12.7.8-12.8.0-12.8.1-12.8.2-12.8.3-12.8.4-12.8.4-22.8.5-12.9.0-12.9.1-12.9.10-12.9.11-12.9.12-12.9.2-12.9.3-12.9.4-12.9.5-12.9.6-12.9.7-12.9.8-12.9.9-13.0.0-13.0.1-13.0.10-13.0.11-13.0.2-13.0.3-13.0.4-13.0.5-13.0.6-13.0.6-23.0.6-33.0.7-1
 None known
haproxy
Debian:13
 All versions, plus listed versions
3.0.11-13.0.11-1+deb13u13.0.11-1+deb13u23.0.11-1+deb13u33.0.11-1+deb13u4
Show 45 moreShow less
3.1.0-13.1.0-23.1.1-13.1.2-13.1.3-13.1.5-13.1.6-13.1.7-13.2.0-13.2.1-13.2.10-13.2.11-13.2.11-23.2.12-13.2.13-13.2.14-13.2.15-13.2.16-13.2.17-13.2.18-13.2.19-13.2.20-13.2.21-13.2.22-13.2.23-13.2.24-13.2.25-13.2.26-13.2.3-13.2.3-23.2.4-13.2.5-13.2.5-23.2.6-13.2.7-13.2.8-13.2.9-13.3.0-13.3.1-13.3.10-13.3.2-13.3.2-23.3.3-13.3.4-13.3.5-1
 None known
haproxy
Debian:14
 before 3.2.20-1, plus listed versions
3.0.11-13.1.0-13.1.0-23.1.1-13.1.2-1
Show 26 moreShow less
3.1.3-13.1.5-13.1.6-13.1.7-13.2.0-13.2.1-13.2.10-13.2.11-13.2.11-23.2.12-13.2.13-13.2.14-13.2.15-13.2.16-13.2.17-13.2.18-13.2.19-13.2.3-13.2.3-23.2.4-13.2.5-13.2.5-23.2.6-13.2.7-13.2.8-13.2.9-1
3.2.20-1
haproxy
Mageia:10
From an advisory covering 2 CVEs
 before 3.4.2-1.2.mga10
3.4.2-1.2.mga10
haproxy
Mageia:9
From an advisory covering 2 CVEs
 before 2.8.26-1.mga9
2.8.26-1.mga9
haproxy
openEuler:20.03-LTS-SP4
From an advisory covering 2 CVEs
 before 2.2.16-10.oe2003sp4
2.2.16-10.oe2003sp4
haproxy
openEuler:22.03-LTS-SP4
From an advisory covering 2 CVEs
 before 2.6.6-20.oe2203sp4
2.6.6-20.oe2203sp4
haproxy
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 2.9.5-14.oe2403sp1
2.9.5-14.oe2403sp1
haproxy
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 3.0.11-3.oe2403sp3
3.0.11-3.oe2403sp3
haproxy
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:3.0.25-0.1.hum1
0:3.0.25-0.1.hum1
haproxy
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:3.0.5-6.el10_2.2
0:3.0.5-6.el10_2.2
haproxy-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:3.0.5-6.el10_2.2
0:3.0.5-6.el10_2.2
haproxy-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:3.0.5-6.el10_2.2
0:3.0.5-6.el10_2.2
haproxy
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:2.8.14-3.el9_8.2
0:2.8.14-3.el9_8.2
haproxy-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:2.8.14-3.el9_8.2
0:2.8.14-3.el9_8.2
haproxy-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:2.8.14-3.el9_8.2
0:2.8.14-3.el9_8.2
haproxy
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 0:3.0.5-4.el10_0.3
0:3.0.5-4.el10_0.3
haproxy-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 0:3.0.5-4.el10_0.3
0:3.0.5-4.el10_0.3
haproxy-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 0:3.0.5-4.el10_0.3
0:3.0.5-4.el10_0.3
haproxy
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 2 CVEs
 before 0:2.4.22-3.el9_4.3
0:2.4.22-3.el9_4.3
haproxy-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 2 CVEs
 before 0:2.4.22-3.el9_4.3
0:2.4.22-3.el9_4.3
haproxy-debugsource
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 2 CVEs
 before 0:2.4.22-3.el9_4.3
0:2.4.22-3.el9_4.3
haproxy
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 2 CVEs
 before 0:2.4.17-6.el9_2.5
0:2.4.17-6.el9_2.5
haproxy-debuginfo
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 2 CVEs
 before 0:2.4.17-6.el9_2.5
0:2.4.17-6.el9_2.5
haproxy-debugsource
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 2 CVEs
 before 0:2.4.17-6.el9_2.5
0:2.4.17-6.el9_2.5
haproxy
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:2.4.22-4.el9_6.3
0:2.4.22-4.el9_6.3
haproxy-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:2.4.22-4.el9_6.3
0:2.4.22-4.el9_6.3
haproxy-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:2.4.22-4.el9_6.3
0:2.4.22-4.el9_6.3
haproxy
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.27-5.el8_10.2
0:1.8.27-5.el8_10.2
haproxy-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.27-5.el8_10.2
0:1.8.27-5.el8_10.2
haproxy-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.27-5.el8_10.2
0:1.8.27-5.el8_10.2
haproxy
Red Hat:rhel_e4s:8.8::appstream
 before 0:1.8.27-5.el8_8.2
0:1.8.27-5.el8_8.2
haproxy-debuginfo
Red Hat:rhel_e4s:8.8::appstream
 before 0:1.8.27-5.el8_8.2
0:1.8.27-5.el8_8.2
haproxy-debugsource
Red Hat:rhel_e4s:8.8::appstream
 before 0:1.8.27-5.el8_8.2
0:1.8.27-5.el8_8.2
haproxy
Red Hat:rhel_tus:8.8::appstream
 before 0:1.8.27-5.el8_8.2
0:1.8.27-5.el8_8.2
haproxy-debuginfo
Red Hat:rhel_tus:8.8::appstream
 before 0:1.8.27-5.el8_8.2
0:1.8.27-5.el8_8.2
haproxy-debugsource
Red Hat:rhel_tus:8.8::appstream
 before 0:1.8.27-5.el8_8.2
0:1.8.27-5.el8_8.2
haproxy
Red Hat:rhel_aus:8.4::appstream
 before 0:1.8.27-2.el8_4.2
0:1.8.27-2.el8_4.2
haproxy-debuginfo
Red Hat:rhel_aus:8.4::appstream
 before 0:1.8.27-2.el8_4.2
0:1.8.27-2.el8_4.2
haproxy-debugsource
Red Hat:rhel_aus:8.4::appstream
 before 0:1.8.27-2.el8_4.2
0:1.8.27-2.el8_4.2
haproxy
Red Hat:rhel_eus_long_life:8.4::appstream
 before 0:1.8.27-2.el8_4.2
0:1.8.27-2.el8_4.2
haproxy-debuginfo
Red Hat:rhel_eus_long_life:8.4::appstream
 before 0:1.8.27-2.el8_4.2
0:1.8.27-2.el8_4.2
haproxy-debugsource
Red Hat:rhel_eus_long_life:8.4::appstream
 before 0:1.8.27-2.el8_4.2
0:1.8.27-2.el8_4.2
haproxy
Red Hat:rhel_aus:8.6::appstream
 before 0:1.8.27-4.el8_6.2
0:1.8.27-4.el8_6.2
haproxy-debuginfo
Red Hat:rhel_aus:8.6::appstream
 before 0:1.8.27-4.el8_6.2
0:1.8.27-4.el8_6.2
haproxy-debugsource
Red Hat:rhel_aus:8.6::appstream
 before 0:1.8.27-4.el8_6.2
0:1.8.27-4.el8_6.2
haproxy
Red Hat:rhel_eus_long_life:8.6::appstream
 before 0:1.8.27-4.el8_6.2
0:1.8.27-4.el8_6.2
haproxy-debuginfo
Red Hat:rhel_eus_long_life:8.6::appstream
 before 0:1.8.27-4.el8_6.2
0:1.8.27-4.el8_6.2
haproxy-debugsource
Red Hat:rhel_eus_long_life:8.6::appstream
 before 0:1.8.27-4.el8_6.2
0:1.8.27-4.el8_6.2
haproxy
Rocky Linux:10
From an advisory covering 2 CVEs
 before 0:3.0.5-6.el10_2.2
0:3.0.5-6.el10_2.2
haproxy
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:2.8.14-3.el9_8.2
0:2.8.14-3.el9_8.2
haproxy
Rocky Linux:8
 before 0:1.8.27-5.el8_10.2
0:1.8.27-5.el8_10.2
haproxy
SUSE:Linux Micro 6.0
From an advisory covering 2 CVEs
 before 2.8.11+git0.01c1056a4-4.1
2.8.11+git0.01c1056a4-4.1
haproxy
SUSE:Linux Micro 6.2
From an advisory covering 2 CVEs
 before 3.2.21+git0.dbe43be37-160000.1.1
3.2.21+git0.dbe43be37-160000.1.1
haproxy
SUSE:Linux Enterprise High Availability Extension 16.0
From an advisory covering 2 CVEs
 before 3.2.21+git0.dbe43be37-160000.1.1
3.2.21+git0.dbe43be37-160000.1.1
haproxy
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 3.2.21+git0.dbe43be37-160000.1.1
3.2.21+git0.dbe43be37-160000.1.1
haproxy
SUSE:Linux Micro 6.1
From an advisory covering 2 CVEs
 before 2.8.11+git0.01c1056a4-slfo.1.1_4.1
2.8.11+git0.01c1056a4-slfo.1.1_4.1
haproxy
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 2 CVEs
 before 2.4.22+git0.f8e3218e2-150400.3.28.1
2.4.22+git0.f8e3218e2-150400.3.28.1
haproxy
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 2 CVEs
 before 2.4.22+git0.f8e3218e2-150400.3.28.1
2.4.22+git0.f8e3218e2-150400.3.28.1
haproxy
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 2 CVEs
 before 2.4.22+git0.f8e3218e2-150400.3.28.1
2.4.22+git0.f8e3218e2-150400.3.28.1
haproxy
SUSE:Linux Enterprise High Availability Extension 15 SP4
From an advisory covering 2 CVEs
 before 2.4.22+git0.f8e3218e2-150400.3.28.1
2.4.22+git0.f8e3218e2-150400.3.28.1
haproxy
SUSE:Linux Enterprise High Availability Extension 15 SP5
From an advisory covering 2 CVEs
 before 2.4.22+git0.f8e3218e2-150400.3.28.1
2.4.22+git0.f8e3218e2-150400.3.28.1
haproxy
SUSE:Linux Enterprise High Availability Extension 15 SP6
From an advisory covering 2 CVEs
 before 2.8.11+git0.01c1056a4-150600.3.15.1
2.8.11+git0.01c1056a4-150600.3.15.1
haproxy
SUSE:Linux Enterprise High Availability Extension 15 SP7
From an advisory covering 2 CVEs
 before 2.8.11+git0.01c1056a4-150600.3.15.1
2.8.11+git0.01c1056a4-150600.3.15.1
haproxy
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.5.14-11.5.15-11.6.2-11.6.2-21.6.2-2ubuntu1
Show 7 moreShow less
1.6.2-2ubuntu31.6.3-11.6.3-1ubuntu0.11.6.3-1ubuntu0.21.6.3-1ubuntu0.31.6.3-1ubuntu0.3+esm11.6.3-1ubuntu0.3+esm2
 None known
haproxy
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.7.9-1ubuntu11.7.9-1ubuntu21.8.4-11.8.7-11.8.8-1
Show 13 moreShow less
1.8.8-1ubuntu0.11.8.8-1ubuntu0.21.8.8-1ubuntu0.31.8.8-1ubuntu0.41.8.8-1ubuntu0.61.8.8-1ubuntu0.71.8.8-1ubuntu0.81.8.8-1ubuntu0.91.8.8-1ubuntu0.101.8.8-1ubuntu0.111.8.8-1ubuntu0.131.8.8-1ubuntu0.13+esm21.8.8-1ubuntu0.13+esm3
 None known
haproxy
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.0.5-12.0.8-12.0.9-12.0.10-12.0.10-1ubuntu1
Show 15 moreShow less
2.0.11-1ubuntu12.0.12-1ubuntu22.0.13-1ubuntu22.0.13-22.0.13-2ubuntu0.12.0.13-2ubuntu0.22.0.13-2ubuntu0.32.0.13-2ubuntu0.52.0.29-0ubuntu12.0.29-0ubuntu1.12.0.29-0ubuntu1.32.0.31-0ubuntu0.12.0.31-0ubuntu0.22.0.31-0ubuntu0.32.0.33-0ubuntu0.1
 None known
haproxy
Ubuntu:22.04:LTS
 before 2.4.30-0ubuntu0.22.04.2, plus listed versions
2.2.9-2ubuntu22.4.8-12.4.8-2ubuntu32.4.11-1ubuntu12.4.12-1ubuntu1
Show 15 moreShow less
2.4.12-1ubuntu22.4.13-1ubuntu12.4.14-1ubuntu12.4.18-0ubuntu12.4.18-0ubuntu1.12.4.18-0ubuntu1.22.4.18-0ubuntu1.32.4.22-0ubuntu0.22.04.12.4.22-0ubuntu0.22.04.22.4.22-0ubuntu0.22.04.32.4.24-0ubuntu0.22.04.12.4.24-0ubuntu0.22.04.22.4.24-0ubuntu0.22.04.32.4.29-0ubuntu0.22.04.12.4.30-0ubuntu0.22.04.1
2.4.30-0ubuntu0.22.04.2
haproxy
Ubuntu:24.04:LTS
 before 2.8.16-0ubuntu0.24.04.3, plus listed versions
2.6.15-1ubuntu22.8.5-1ubuntu12.8.5-1ubuntu22.8.5-1ubuntu32.8.5-1ubuntu3.1
Show 6 moreShow less
2.8.5-1ubuntu3.22.8.5-1ubuntu3.32.8.5-1ubuntu3.42.8.15-0ubuntu0.24.04.12.8.16-0ubuntu0.24.04.12.8.16-0ubuntu0.24.04.2
2.8.16-0ubuntu0.24.04.3
haproxy
Ubuntu:25.10
 before 3.0.12-0ubuntu0.25.10.5, plus listed versions
3.0.8-1ubuntu13.0.8-1ubuntu1.13.0.10-1ubuntu13.0.10-1ubuntu23.0.10-1ubuntu33.0.12-0ubuntu0.25.10.13.0.12-0ubuntu0.25.10.33.0.12-0ubuntu0.25.10.4
3.0.12-0ubuntu0.25.10.5
haproxy
Ubuntu:26.04:LTS
 before 3.2.9-1ubuntu2.2, plus listed versions
3.0.10-1ubuntu33.2.9-1ubuntu13.2.9-1ubuntu23.2.9-1ubuntu2.1
3.2.9-1ubuntu2.2
haproxy
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 3.4.0+git31.fc300e9f2-1.1
3.4.0+git31.fc300e9f2-1.1
haproxy
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 3.2.21+git0.dbe43be37-160000.1.1
3.2.21+git0.dbe43be37-160000.1.1

History

History
RecordedChangedSources
affectedOSV
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-55204 is a high vulnerability (CVSS 8.7) in Haproxy, published June 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in haproxy 1.8.27-5.el8_10.2.

References

Show 66 moreShow less
This page doesn't list everything

Left out here: 69 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open