{"id":"USN-8972-2","aliases":[],"status":"published","title":"haproxy regression","description":"USN-8972-1 fixed vulnerabilities in HAProxy. On Ubuntu 22.04 LTS, the\nupdate caused a regression when processing certain chunked requests. This\nupdate fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that HAProxy incorrectly handled truncated HTTP/2\n PING frames. A remote attacker could possibly use this issue to cause\n HAProxy to consume excessive CPU resources, leading to a denial of\n service. (CVE-2026-110353)\n\n It was discovered that HAProxy incorrectly handled certain HTTP/1.1\n chunked requests. A remote attacker could possibly use this issue to\n cause HAProxy to consume excessive CPU resources, leading to a denial\n of service. (CVE-2026-110354)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-11-05T12:52:52Z","modified":"2026-11-06T01:00:34Z","fixes":[{"ecosystem":"Ubuntu:22.04:LTS","package":"haproxy","fixed_in":["2.4.30-0ubuntu0.22.04.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.30-0ubuntu0.22.04.4"}]}],"versions":["2.2.9-2ubuntu2","2.4.8-1","2.4.8-2ubuntu3","2.4.11-1ubuntu1","2.4.12-1ubuntu1","2.4.12-1ubuntu2","2.4.13-1ubuntu1","2.4.14-1ubuntu1","2.4.18-0ubuntu1","2.4.18-0ubuntu1.1","2.4.18-0ubuntu1.2","2.4.18-0ubuntu1.3","2.4.22-0ubuntu0.22.04.1","2.4.22-0ubuntu0.22.04.2","2.4.22-0ubuntu0.22.04.3","2.4.24-0ubuntu0.22.04.1","2.4.24-0ubuntu0.22.04.2","2.4.24-0ubuntu0.22.04.3","2.4.29-0ubuntu0.22.04.1","2.4.30-0ubuntu0.22.04.1","2.4.30-0ubuntu0.22.04.2","2.4.30-0ubuntu0.22.04.3"]}],"references":[{"url":"https://ubuntu.com/security/notices/USN-8972-2","tags":["advisory"]},{"url":"https://bugs.launchpad.net/bugs/2172897","tags":["report"]}],"sources":{"osv":[{"id":"USN-8972-2","title":"haproxy regression","description":"USN-8972-1 fixed vulnerabilities in HAProxy. On Ubuntu 22.04 LTS, the\nupdate caused a regression when processing certain chunked requests. This\nupdate fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that HAProxy incorrectly handled truncated HTTP/2\n PING frames. A remote attacker could possibly use this issue to cause\n HAProxy to consume excessive CPU resources, leading to a denial of\n service. (CVE-2026-110353)\n\n It was discovered that HAProxy incorrectly handled certain HTTP/1.1\n chunked requests. A remote attacker could possibly use this issue to\n cause HAProxy to consume excessive CPU resources, leading to a denial\n of service. (CVE-2026-110354)","status":"published","published":"2026-11-05T12:52:52Z","modified":"2026-11-06T01:00:34.369277796Z","updated_at":"2026-11-06T01:33:05.666804Z"}]}}