USN-8972-2
haproxy regression
USN-8972-2 is a vulnerability with no CVSS score yet in haproxy, published November 5, 2026. No source lists public exploit code. Fixed in haproxy 2.4.30-0ubuntu0.22.04.4.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.4.30-0ubuntu0.22.04.4haproxy
Description
USN-8972-1 fixed vulnerabilities in HAProxy. On Ubuntu 22.04 LTS, the update caused a regression when processing certain chunked requests. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that HAProxy incorrectly handled truncated HTTP/2 PING frames. A remote attacker could possibly use this issue to cause HAProxy to consume excessive CPU resources, leading to a denial of service. (CVE-2026-110353)
It was discovered that HAProxy incorrectly handled certain HTTP/1.1 chunked requests. A remote attacker could possibly use this issue to cause HAProxy to consume excessive CPU resources, leading to a denial of service. (CVE-2026-110354)
Affected packages
| Package | Affected | Fixed |
|---|---|---|
haproxyUbuntu:22.04:LTS | before 2.4.30-0ubuntu0.22.04.4, plus listed versions 2.2.9-2ubuntu22.4.8-12.4.8-2ubuntu32.4.11-1ubuntu12.4.12-1ubuntu1 Show 17 moreShow less2.4.12-1ubuntu22.4.13-1ubuntu12.4.14-1ubuntu12.4.18-0ubuntu12.4.18-0ubuntu1.12.4.18-0ubuntu1.22.4.18-0ubuntu1.32.4.22-0ubuntu0.22.04.12.4.22-0ubuntu0.22.04.22.4.22-0ubuntu0.22.04.32.4.24-0ubuntu0.22.04.12.4.24-0ubuntu0.22.04.22.4.24-0ubuntu0.22.04.32.4.29-0ubuntu0.22.04.12.4.30-0ubuntu0.22.04.12.4.30-0ubuntu0.22.04.22.4.30-0ubuntu0.22.04.3 | 2.4.30-0ubuntu0.22.04.4 |
What each source reports
OSVNo score
haproxy regression
USN-8972-1 fixed vulnerabilities in HAProxy. On Ubuntu 22.04 LTS, the update caused a regression when processing certain chunked requests. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that HAProxy incorrectly handled truncated HTTP/2 PING frames. A remote attacker could possibly use this issue to cause HAProxy to consume excessive CPU resources, leading to a denial of service. (CVE-2026-110353)
It was discovered that HAProxy incorrectly handled certain HTTP/1.1 chunked requests. A remote attacker could possibly use this issue to cause HAProxy to consume excessive CPU resources, leading to a denial of service. (CVE-2026-110354)
- Record
USN-8972-2- Updated
- 2026-11-06
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.