{"id":"CVE-2026-55204","aliases":["ALSA-2026:55679","ALSA-2026:55772","ALSA-2026:55859","AZL-90261","BIT-haproxy-2026-55204","CLSA-2026-1782820521","CLSA-2026-1782825341","CLSA-2026-1782825734","CLSA-2026-1782825982","CLSA-2026-1782895938","CLSA-2026-1782896085","CLSA-2026-1783527210","CLSA-2026-1784545904","DEBIAN-CVE-2026-55204","EUVD-2026-37906","GHSA-4vj2-5mvx-3vcc","MGASA-2026-0250","OESA-2026-2794","RHSA-2026:35453","RHSA-2026:55679","RHSA-2026:55772","RHSA-2026:55800","RHSA-2026:55801","RHSA-2026:55802","RHSA-2026:55803","RHSA-2026:55859","RHSA-2026:55860","RHSA-2026:55861","RHSA-2026:55862","RLSA-2026:55679","RLSA-2026:55772","RLSA-2026:55859","SUSE-SU-2026:22515-1","SUSE-SU-2026:22544-1","SUSE-SU-2026:22557-1","SUSE-SU-2026:22587-1","SUSE-SU-2026:22663-1","SUSE-SU-2026:2651-1","SUSE-SU-2026:2652-1","UBUNTU-CVE-2026-55204","openSUSE-SU-2026:11090-1","openSUSE-SU-2026:21245-1"],"status":"published","title":"HAProxy - NULL Pointer Dereference in hpack_dht_insert Function","description":"HAProxy through  3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00484,"percentile":0.42152,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2026-06-18T16:05:52Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"haproxy","fixed_in":["1.8.27-5.el8_10.2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"haproxy","fixed_in":["2.9.11-7"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"haproxy","fixed_in":["2.4.36","2.6.30","2.8.25","3.0.24","3.2.20","3.4.1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"haproxy","fixed_in":["2.4.22-4.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"haproxy","fixed_in":["1.8.27-5.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"haproxy","fixed_in":["1.8.27-2.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"haproxy","fixed_in":["1.8.27-2.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"haproxy","fixed_in":["1.8.19-1+deb10u5+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"haproxy-doc","fixed_in":["1.8.19-1+deb10u5+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"vim-haproxy","fixed_in":["1.8.19-1+deb10u5+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"haproxy","fixed_in":["2.0.33-0ubuntu0.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"haproxy-doc","fixed_in":["2.0.33-0ubuntu0.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"vim-haproxy","fixed_in":["2.0.33-0ubuntu0.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"haproxy","fixed_in":["2.4.17-6.el9.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"haproxy","fixed_in":["1.8.8-1ubuntu0.13.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"haproxy-doc","fixed_in":["1.8.8-1ubuntu0.13.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-haproxy","fixed_in":["1.8.8-1ubuntu0.13.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"haproxy","fixed_in":["3.2.20-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"haproxy","fixed_in":["0:1.8.27-5.el8_10.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"haproxy-debuginfo","fixed_in":["0:1.8.27-5.el8_10.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"haproxy-debugsource","fixed_in":["0:1.8.27-5.el8_10.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"haproxy","fixed_in":["0:1.8.27-5.el8_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"haproxy-debuginfo","fixed_in":["0:1.8.27-5.el8_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"haproxy-debugsource","fixed_in":["0:1.8.27-5.el8_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"haproxy","fixed_in":["0:1.8.27-5.el8_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"haproxy-debuginfo","fixed_in":["0:1.8.27-5.el8_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"haproxy-debugsource","fixed_in":["0:1.8.27-5.el8_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"haproxy","fixed_in":["0:1.8.27-2.el8_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"haproxy-debuginfo","fixed_in":["0:1.8.27-2.el8_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"haproxy-debugsource","fixed_in":["0:1.8.27-2.el8_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"haproxy","fixed_in":["0:1.8.27-2.el8_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"haproxy-debuginfo","fixed_in":["0:1.8.27-2.el8_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"haproxy-debugsource","fixed_in":["0:1.8.27-2.el8_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"haproxy","fixed_in":["0:1.8.27-4.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"haproxy-debuginfo","fixed_in":["0:1.8.27-4.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"haproxy-debugsource","fixed_in":["0:1.8.27-4.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"haproxy","fixed_in":["0:1.8.27-4.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"haproxy-debuginfo","fixed_in":["0:1.8.27-4.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"haproxy-debugsource","fixed_in":["0:1.8.27-4.el8_6.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"haproxy","fixed_in":["0:1.8.27-5.el8_10.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"haproxy","fixed_in":["2.4.30-0ubuntu0.22.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"haproxy","fixed_in":["2.8.16-0ubuntu0.24.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"haproxy","fixed_in":["3.0.12-0ubuntu0.25.10.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"haproxy","fixed_in":["3.2.9-1ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-6.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.14-3.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-5.el8_10.2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.11-7"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"haproxy","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.36"},{"introduced":"2.5.0"},{"fixed":"2.6.30"},{"introduced":"2.7.0"},{"fixed":"2.8.25"},{"introduced":"2.9.0"},{"fixed":"3.0.24"},{"introduced":"3.1.0"},{"fixed":"3.2.20"},{"introduced":"3.3.0"},{"fixed":"3.4.1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22-4.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-5.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-2.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-2.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.19-1+deb10u5+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"haproxy-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.19-1+deb10u5+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"vim-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.19-1+deb10u5+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.33-0ubuntu0.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"haproxy-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.33-0ubuntu0.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"vim-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.33-0ubuntu0.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17-6.el9.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1ubuntu0.13.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"haproxy-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1ubuntu0.13.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1ubuntu0.13.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.12-1","2.6.12-1+deb12u1","2.6.12-1+deb12u2","2.6.12-1+deb12u3","2.6.12-1+deb12u4","2.6.13-1","2.6.14-1","2.6.15-1","2.7.0-1","2.7.1-1","2.7.2-1","2.7.2-2","2.7.3-1","2.7.4-1","2.7.5-1","2.7.6-1","2.7.7-1","2.7.8-1","2.8.0-1","2.8.1-1","2.8.2-1","2.8.3-1","2.8.4-1","2.8.4-2","2.8.5-1","2.9.0-1","2.9.1-1","2.9.10-1","2.9.11-1","2.9.12-1","2.9.2-1","2.9.3-1","2.9.4-1","2.9.5-1","2.9.6-1","2.9.7-1","2.9.8-1","2.9.9-1","3.0.0-1","3.0.1-1","3.0.10-1","3.0.11-1","3.0.2-1","3.0.3-1","3.0.4-1","3.0.5-1","3.0.6-1","3.0.6-2","3.0.6-3","3.0.7-1","3.0.8-1","3.0.9-1","3.1.0-1","3.1.0-2","3.1.1-1","3.1.2-1","3.1.3-1","3.1.5-1","3.1.6-1","3.1.7-1","3.2.0-1","3.2.1-1","3.2.10-1","3.2.11-1","3.2.11-2","3.2.12-1","3.2.13-1","3.2.14-1","3.2.15-1","3.2.16-1","3.2.17-1","3.2.18-1","3.2.19-1","3.2.20-1","3.2.21-1","3.2.22-1","3.2.23-1","3.2.24-1","3.2.25-1","3.2.26-1","3.2.3-1","3.2.3-2","3.2.4-1","3.2.5-1","3.2.5-2","3.2.6-1","3.2.7-1","3.2.8-1","3.2.9-1","3.3.0-1","3.3.1-1","3.3.10-1","3.3.2-1","3.3.2-2","3.3.3-1","3.3.4-1","3.3.5-1","3.3.6-1","3.3.7-1","3.3.8-1","3.3.9-1","3.4.0-1","3.4.1-1","3.4.2-1","3.4.3-1","3.4.4-1","3.4.6-1","3.4.7-1"]},{"source":"osv","ecosystem":"Debian:13","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.11-1","3.0.11-1+deb13u1","3.0.11-1+deb13u2","3.0.11-1+deb13u3","3.0.11-1+deb13u4","3.1.0-1","3.1.0-2","3.1.1-1","3.1.2-1","3.1.3-1","3.1.5-1","3.1.6-1","3.1.7-1","3.2.0-1","3.2.1-1","3.2.10-1","3.2.11-1","3.2.11-2","3.2.12-1","3.2.13-1","3.2.14-1","3.2.15-1","3.2.16-1","3.2.17-1","3.2.18-1","3.2.19-1","3.2.20-1","3.2.21-1","3.2.22-1","3.2.23-1","3.2.24-1","3.2.25-1","3.2.26-1","3.2.3-1","3.2.3-2","3.2.4-1","3.2.5-1","3.2.5-2","3.2.6-1","3.2.7-1","3.2.8-1","3.2.9-1","3.3.0-1","3.3.1-1","3.3.10-1","3.3.2-1","3.3.2-2","3.3.3-1","3.3.4-1","3.3.5-1","3.3.6-1","3.3.7-1","3.3.8-1","3.3.9-1","3.4.0-1","3.4.1-1","3.4.2-1","3.4.3-1","3.4.4-1","3.4.6-1","3.4.7-1"]},{"source":"osv","ecosystem":"Debian:14","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.20-1"}]}],"versions":["3.0.11-1","3.1.0-1","3.1.0-2","3.1.1-1","3.1.2-1","3.1.3-1","3.1.5-1","3.1.6-1","3.1.7-1","3.2.0-1","3.2.1-1","3.2.10-1","3.2.11-1","3.2.11-2","3.2.12-1","3.2.13-1","3.2.14-1","3.2.15-1","3.2.16-1","3.2.17-1","3.2.18-1","3.2.19-1","3.2.3-1","3.2.3-2","3.2.4-1","3.2.5-1","3.2.5-2","3.2.6-1","3.2.7-1","3.2.8-1","3.2.9-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-1.2.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.26-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-10.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-20.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.5-14.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-3.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.25-0.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.5-6.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.5-6.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.5-6.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.14-3.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.14-3.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.14-3.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.5-4.el10_0.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.5-4.el10_0.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.5-4.el10_0.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-3.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-3.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-3.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.17-6.el9_2.5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.17-6.el9_2.5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.17-6.el9_2.5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-4.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-4.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.22-4.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-5.el8_10.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-5.el8_10.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-5.el8_10.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-5.el8_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-5.el8_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-5.el8_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-5.el8_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-5.el8_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-5.el8_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-2.el8_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-2.el8_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-2.el8_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-2.el8_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-2.el8_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-2.el8_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-4.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-4.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-4.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-4.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-4.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-4.el8_6.2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.5-6.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.14-3.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.27-5.el8_10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.11+git0.01c1056a4-4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.21+git0.dbe43be37-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 16.0","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.21+git0.dbe43be37-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.21+git0.dbe43be37-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.11+git0.01c1056a4-slfo.1.1_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP5","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.22+git0.f8e3218e2-150400.3.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.11+git0.01c1056a4-150600.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.11+git0.01c1056a4-150600.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.14-1","1.5.15-1","1.6.2-1","1.6.2-2","1.6.2-2ubuntu1","1.6.2-2ubuntu3","1.6.3-1","1.6.3-1ubuntu0.1","1.6.3-1ubuntu0.2","1.6.3-1ubuntu0.3","1.6.3-1ubuntu0.3+esm1","1.6.3-1ubuntu0.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.9-1ubuntu1","1.7.9-1ubuntu2","1.8.4-1","1.8.7-1","1.8.8-1","1.8.8-1ubuntu0.1","1.8.8-1ubuntu0.2","1.8.8-1ubuntu0.3","1.8.8-1ubuntu0.4","1.8.8-1ubuntu0.6","1.8.8-1ubuntu0.7","1.8.8-1ubuntu0.8","1.8.8-1ubuntu0.9","1.8.8-1ubuntu0.10","1.8.8-1ubuntu0.11","1.8.8-1ubuntu0.13","1.8.8-1ubuntu0.13+esm2","1.8.8-1ubuntu0.13+esm3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.5-1","2.0.8-1","2.0.9-1","2.0.10-1","2.0.10-1ubuntu1","2.0.11-1ubuntu1","2.0.12-1ubuntu2","2.0.13-1ubuntu2","2.0.13-2","2.0.13-2ubuntu0.1","2.0.13-2ubuntu0.2","2.0.13-2ubuntu0.3","2.0.13-2ubuntu0.5","2.0.29-0ubuntu1","2.0.29-0ubuntu1.1","2.0.29-0ubuntu1.3","2.0.31-0ubuntu0.1","2.0.31-0ubuntu0.2","2.0.31-0ubuntu0.3","2.0.33-0ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.30-0ubuntu0.22.04.2"}]}],"versions":["2.2.9-2ubuntu2","2.4.8-1","2.4.8-2ubuntu3","2.4.11-1ubuntu1","2.4.12-1ubuntu1","2.4.12-1ubuntu2","2.4.13-1ubuntu1","2.4.14-1ubuntu1","2.4.18-0ubuntu1","2.4.18-0ubuntu1.1","2.4.18-0ubuntu1.2","2.4.18-0ubuntu1.3","2.4.22-0ubuntu0.22.04.1","2.4.22-0ubuntu0.22.04.2","2.4.22-0ubuntu0.22.04.3","2.4.24-0ubuntu0.22.04.1","2.4.24-0ubuntu0.22.04.2","2.4.24-0ubuntu0.22.04.3","2.4.29-0ubuntu0.22.04.1","2.4.30-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.16-0ubuntu0.24.04.3"}]}],"versions":["2.6.15-1ubuntu2","2.8.5-1ubuntu1","2.8.5-1ubuntu2","2.8.5-1ubuntu3","2.8.5-1ubuntu3.1","2.8.5-1ubuntu3.2","2.8.5-1ubuntu3.3","2.8.5-1ubuntu3.4","2.8.15-0ubuntu0.24.04.1","2.8.16-0ubuntu0.24.04.1","2.8.16-0ubuntu0.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-0ubuntu0.25.10.5"}]}],"versions":["3.0.8-1ubuntu1","3.0.8-1ubuntu1.1","3.0.10-1ubuntu1","3.0.10-1ubuntu2","3.0.10-1ubuntu3","3.0.12-0ubuntu0.25.10.1","3.0.12-0ubuntu0.25.10.3","3.0.12-0ubuntu0.25.10.4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.9-1ubuntu2.2"}]}],"versions":["3.0.10-1ubuntu3","3.2.9-1ubuntu1","3.2.9-1ubuntu2","3.2.9-1ubuntu2.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0+git31.fc300e9f2-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.21+git0.dbe43be37-160000.1.1"}]}],"bundled":2}],"products":[{"vendor":"haproxy","product":"haproxy"}],"references":[{"url":"https://github.com/haproxy/haproxy/commit/9a6d1fe3f00d86ab4ea6ea6ea0a5d48fc058a513","tags":["patch","Patch","fix","article"]},{"url":"https://www.vulncheck.com/advisories/haproxy-null-pointer-dereference-in-hpack-dht-insert-function","tags":["third-party-advisory","Third Party Advisory","advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55204","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-4vj2-5mvx-3vcc"},{"url":"https://access.redhat.com/errata/RHSA-2026:55679","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55203","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55204","tags":["report"]},{"url":"https://bugzilla.redhat.com/2490518","tags":["report"]},{"url":"https://bugzilla.redhat.com/2490522","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-55679.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55772","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-55772.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55859","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-55859.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1782820521.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1782825341.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1782825734.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1782825982.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1782895938.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1782896085.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1783527210.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1784545904.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55204.json","tags":["advisory"]},{"url":"https://github.com/haproxy/haproxy","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-55204","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0250.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35748","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2794","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55203","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:35453","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_35453.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490522","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55203","tags":["advisory"]},{"url":"https://github.com/haproxy/haproxy/commit/5985276735777634d8c85f1d73bb7764aab0d6dd","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/haproxy-integer-overflow-in-fcgi-demux-record-length-field","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490518","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55204","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55679.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55772.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55800","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55800.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55801","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55801.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55802","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55802.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55803","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55803.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55859.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55860","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55860.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55861","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55861.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55862","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55862.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:55679","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:55772","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:55859","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622515-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268557","tags":["report"]},{"url":"https://bugzilla.suse.com/1268558","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55204","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622544-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622557-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622587-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622663-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262651-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262652-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-55204","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8459-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-55204","title":"HAProxy - NULL Pointer Dereference in hpack_dht_insert Function","description":"HAProxy through  3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.","status":"published","published":"2026-06-18T16:05:52.058Z","modified":"2026-07-14T21:33:57.879Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:20:12.260247Z"}],"euvd":[{"id":"EUVD-2026-37906","description":"HAProxy through  3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.","status":"published","published":"2026-06-18T16:05:52Z","modified":"2026-07-14T21:33:57Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:19:58.306277Z"}],"ghsa":[{"id":"GHSA-4vj2-5mvx-3vcc","title":"HAProxy through  3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference...","description":"HAProxy through  3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.","status":"published","published":"2026-06-18T18:35:24Z","modified":"2026-06-18T18:35:31Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:08:54.452189Z"}],"nvd":[{"id":"CVE-2026-55204","description":"HAProxy through  3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.","status":"published","published":"2026-06-18T17:16:34.567Z","modified":"2026-10-26T11:10:00.157Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"CVE-2026-55204","title":"HAProxy - NULL Pointer Dereference in hpack_dht_insert Function","description":"HAProxy through  3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.","status":"published","published":"2026-06-18T16:05:52.058Z","modified":"2026-11-11T13:26:45.445055461Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-11T03:22:28.447808Z"},{"id":"DEBIAN-CVE-2026-55204","description":"HAProxy through  3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.","status":"published","published":"2026-06-18T17:16:34.567Z","modified":"2026-10-27T10:01:44.880924608Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"OESA-2026-2794","title":"haproxy security update","description":"HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world\u0026amp;apos;s most visited ones.\r\n\r\nSecurity Fix(es):\n\nHAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure\u0026apos;s drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.(CVE-2026-55203)\n\nHAProxy through  3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.(CVE-2026-55204)","status":"published","published":"2026-06-24T11:11:43Z","modified":"2026-08-18T01:21:12.568154526Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"RHSA-2026:35453","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-17T10:08:06Z","modified":"2026-10-16T10:16:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:55679","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2026-08-18T10:21:05Z","modified":"2026-10-16T10:20:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55772","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2026-08-18T10:21:10Z","modified":"2026-10-16T10:20:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55800","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2026-08-18T10:21:11Z","modified":"2026-10-16T10:20:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55801","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2026-08-18T10:21:12Z","modified":"2026-10-16T10:20:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55802","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2026-08-18T10:21:12Z","modified":"2026-10-16T10:20:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55803","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2026-08-18T10:21:13Z","modified":"2026-10-16T10:20:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55859","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2026-08-18T10:21:17Z","modified":"2026-10-16T10:20:17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55860","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2026-08-18T10:21:17Z","modified":"2026-10-16T10:20:17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55861","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2026-08-18T10:21:17Z","modified":"2026-10-16T10:20:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55862","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2026-08-18T10:21:18Z","modified":"2026-10-16T10:20:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RLSA-2026:55679","title":"Important: haproxy security update","description":"The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.\n\nSecurity Fix(es):\n\n* haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)\n\n* haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-18T12:07:31.722662Z","modified":"2026-08-18T12:30:03.24626904Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:55772","title":"Important: haproxy security update","description":"The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.\n\nSecurity Fix(es):\n\n* haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)\n\n* haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-18T06:04:25.43626Z","modified":"2026-08-18T06:30:06.130379329Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:55859","title":"Important: haproxy security update","description":"The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.\n\nSecurity Fix(es):\n\n* haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-18T06:01:20.072897Z","modified":"2026-08-18T06:30:07.556753299Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-55204","description":"HAProxy through  3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.","status":"published","published":"2026-06-19T00:00:00Z","modified":"2026-06-24T11:02:00.607443075Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"ALSA-2026:55679","title":"Important: haproxy security update","description":"The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.  \n\nSecurity Fix(es):  \n\n  * haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)\n  * haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-10-29T11:30:38.454878871Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:55772","title":"Important: haproxy security update","description":"The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.  \n\nSecurity Fix(es):  \n\n  * haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)\n  * haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-10-29T11:32:36.644089598Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:55859","title":"Important: haproxy security update","description":"The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.  \n\nSecurity Fix(es):  \n\n  * haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-10-29T11:02:26.490089778Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"AZL-90261","title":"CVE-2026-55204 affecting package haproxy for versions less than 2.9.11-7","description":"HAProxy through  3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.","status":"published","published":"2026-06-18T17:16:34Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"BIT-haproxy-2026-55204","title":"HAProxy - NULL Pointer Dereference in hpack_dht_insert Function","description":"HAProxy through  3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.","status":"published","published":"2026-06-29T05:40:50.508Z","modified":"2026-10-09T12:00:08.136016362Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"CLSA-2026-1782820521","title":"haproxy: Fix of CVE-2026-55204","description":"- CVE-2026-55204: fix NULL pointer dereference in hpack_dht_insert()\n  when the HPACK dynamic table memory pool is exhausted, which could\n  crash the worker process (denial of service)","status":"published","published":"2026-06-30T11:55:36Z","modified":"2026-10-26T09:31:13.189826132Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782825341","title":"haproxy: Fix of CVE-2026-55204","description":"- CVE-2026-55204: fix NULL pointer dereference in hpack_dht_insert()\n  when the HPACK dynamic table memory pool is exhausted, which could\n  crash the worker process (denial of service)","status":"published","published":"2026-06-30T13:15:56Z","modified":"2026-10-26T09:31:37.646859787Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782825734","title":"haproxy: Fix of CVE-2026-55204","description":"- CVE-2026-55204: fix NULL pointer dereference in hpack_dht_insert()\n  when the HPACK dynamic table memory pool is exhausted, which could\n  crash the worker process (denial of service)","status":"published","published":"2026-06-30T13:22:30Z","modified":"2026-10-26T09:31:44.709784049Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782825982","title":"haproxy: Fix of CVE-2026-55204","description":"- CVE-2026-55204: fix NULL pointer dereference in hpack_dht_insert()\n  when the HPACK dynamic table memory pool is exhausted, which could\n  crash the worker process (denial of service)","status":"published","published":"2026-06-30T13:26:37Z","modified":"2026-10-26T09:31:50.22635937Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782895938","title":"Fix CVE(s): CVE-2026-55204","description":"   * SECURITY UPDATE: NULL pointer dereference in HPACK dynamic table insertion\n     - debian/patches/CVE-2026-55204.patch: add missing NULL check after\n       hpack_dht_defrag() in hpack_dht_insert() in src/hpack-tbl.c\n     - CVE-2026-55204","status":"published","published":"2026-07-01T08:52:34Z","modified":"2026-10-26T09:31:52.281837577Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782896085","title":"Fix CVE(s): CVE-2026-55204","description":"   * SECURITY UPDATE: NULL pointer dereference in HPACK dynamic table insertion\n     - debian/patches/CVE-2026-55204.patch: add a missing NULL check after\n       hpack_dht_defrag() at the third call site in hpack_dht_insert() in\n       src/hpack-tbl.c, preventing a worker process crash via NULL dereference\n       when the HPACK table memory pool is exhausted\n     - CVE-2026-55204","status":"published","published":"2026-07-01T08:55:01Z","modified":"2026-10-26T09:32:05.33044313Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1783527210","title":"haproxy: Fix of CVE-2026-55204","description":"- CVE-2026-55204: fix NULL pointer dereference in hpack_dht_insert() by\n  adding a missing NULL check after hpack_dht_defrag() on the data-space\n  defragmentation path, preventing worker SIGSEGV when the HPACK\n  dynamic-table memory pool is exhausted","status":"published","published":"2026-07-08T16:13:51Z","modified":"2026-10-26T09:30:02.902582981Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784545904","title":"Fix CVE(s): CVE-2026-55204","description":"   * SECURITY UPDATE: NULL pointer dereference in the HPACK decoder\n     leading to a worker crash (denial of service)\n     - debian/patches/CVE-2026-55204.patch: add missing NULL check after\n       hpack_dht_defrag() in hpack_dht_insert() when the HPACK dynamic\n       table memory pool is exhausted\n     - CVE-2026-55204","status":"published","published":"2026-07-20T11:12:06Z","modified":"2026-10-26T09:30:09.193854036Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"MGASA-2026-0250","title":"Updated haproxy packages fix security vulnerability","description":"HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow\nvulnerability in the fcgi_conn structure's drl field that allows buffer\nmisparse as new FCGI record headers. When contentLength is 65535 and\npaddingLength is 1 or more, the drl field wraps to 0, causing incorrect\nrecord consumption and allowing malicious FastCGI backends to desynchronize\nthe FCGI framing parser, potentially causing request routing errors, response\nsmuggling, or memory safety issues.\n(CVE-2026-55203)\nHAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer\ndereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that\nfails to validate the return value of hpack_dht_defrag() when the memory pool\nis exhausted. An attacker can trigger HPACK dynamic table insertions under\nmemory pressure to dereference a NULL pointer and crash HAProxy worker\nprocesses, causing denial of service.\n(CVE-2026-55204)\n","status":"published","published":"2026-07-14T01:55:37Z","modified":"2026-07-14T02:00:22.754711982Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11090-1","title":"haproxy-3.4.0+git31.fc300e9f2-1.1 on GA media","description":"These are all security issues fixed in the haproxy-3.4.0+git31.fc300e9f2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-22T00:00:00Z","modified":"2026-06-24T09:00:21.013948835Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21245-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues\n\n- Update to version 3.2.21+git0.dbe43be37\n- CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).\n- CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).\n","status":"published","published":"2026-07-07T10:11:42Z","modified":"2026-07-09T10:00:10.918132201Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22515-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues\n\n- CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as\n  new FCGI record headers (bsc#1268557).\n- CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).\n","status":"published","published":"2026-07-03T12:52:50Z","modified":"2026-07-09T18:24:09.533304818Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22544-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues\n\n- Update to version 3.2.21+git0.dbe43be37\n- CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).\n- CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).\n","status":"published","published":"2026-07-07T10:11:35Z","modified":"2026-07-14T18:24:37.35068066Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22557-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues\n\n- Update to version 3.2.21+git0.dbe43be37\n- CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).\n- CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).\n","status":"published","published":"2026-07-07T10:14:15Z","modified":"2026-07-15T18:24:11.211228218Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22587-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues\n\n- Update to version 3.2.21+git0.dbe43be37\n- CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).\n- CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).\n","status":"published","published":"2026-07-07T10:11:35Z","modified":"2026-07-15T18:24:13.363704144Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22663-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues\n\n- CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as\n  new FCGI record headers (bsc#1268557).\n- CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).\n","status":"published","published":"2026-07-03T12:16:57Z","modified":"2026-07-21T18:48:02.995610235Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2651-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues\n\n- CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as\n  new FCGI record headers (bsc#1268557).\n- CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).\n","status":"published","published":"2026-06-26T12:18:22Z","modified":"2026-06-27T08:45:05.20030527Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2652-1","title":"Security update for haproxy","description":"This update for haproxy fixes the following issues\n\n- CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as\n  new FCGI record headers (bsc#1268557).\n- CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).\n","status":"published","published":"2026-06-26T12:21:05Z","modified":"2026-06-27T08:45:05.194328373Z","updated_at":"2026-11-02T15:54:04.519245Z"}]}}