On this page (7 sections)
Ubuntu published USN-8972-1 on 3 November 2026, covering two HAProxy vulnerabilities. Both let a remote attacker without credentials push HAProxy worker threads to high CPU use, which can take a load balancer or reverse proxy out of service.
If you run HAProxy in front of a website, API or application cluster, particularly on Ubuntu, this is worth patching soon. Because HAProxy often sits on the public edge, a CPU-exhaustion bug there can affect every site behind it.
What was fixed
The Ubuntu notice describes two problems in the haproxy package. The first, CVE-2026-110353, is about truncated HTTP/2 PING frames. The second, CVE-2026-110354, is about certain HTTP/1.1 chunked requests. In both cases Ubuntu says a remote attacker could possibly cause excessive CPU use and a denial of service.
Both are rated High at 7.5 in the GitHub Advisory Database entries, which are marked unreviewed and credit the National Vulnerability Database as publisher. The only impact listed is availability: confidentiality and integrity impact are rated None.
Technical details in plain terms
CVE-2026-110353: truncated HTTP/2 PING frame
According to the advisory, the function h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other HTTP/2 frame handlers. The weakness is classed as CWE-252, Unchecked Return Value. When a PING frame arrives incomplete, its data is never consumed, so the HTTP/2 multiplexer task keeps being woken by the pending data without making progress.
The CPU spins until the timeout http-request setting closes the connection. An attacker who opens many such connections can sustain high CPU usage.
CVE-2026-110354: HTTP/1.1 chunked request
The second advisory describes a parser that repeatedly re-processes the same bytes without making progress, even though the HTTP/1 multiplexer drains the request before closing the stream. It is classed as CWE-835, an infinite loop with an unreachable exit condition.
This one is more persistent. The advisory says the affected thread stays at 100% CPU after timeouts expire and after the client disconnects, and that repeated requests can consume all worker threads until the process is restarted.
Who is exposed
Any HAProxy instance that accepts traffic from untrusted clients is the realistic target. No authentication or user interaction is needed, and the attack vector is the network. The first flaw concerns HTTP/2 PING frames and the second concerns HTTP/1.1 chunked requests, so which listeners and protocols you accept determines which issue applies to you.
Version ranges need care. The CVE text names HAProxy 3.2 (for the PING flaw) and HAProxy 3 (for the chunked flaw) before 3.4.6, but the GitHub advisories list affected and patched versions as unknown. Ubuntu is shipping fixes for older branches too (2.4 and 2.8 packages), so do not assume an older version is safe. Check your distribution's notice or upstream guidance for your exact build.
How to check your version
These read-only commands show the installed HAProxy version. Compare the package version with the fixed versions in the table below.
apt-cache policy haproxyhaproxy -v| Ubuntu release | Fixed haproxy version |
|---|---|
| 26.10 | 3.4.2-1ubuntu4.1 |
| 26.04 LTS | 3.2.25-0ubuntu0.26.04.2 |
| 24.04 LTS | 2.8.30-0ubuntu0.24.04.2 |
| 22.04 LTS | 2.4.30-0ubuntu0.22.04.3 |
What to do now
Ubuntu says a standard system update makes the necessary changes. This command upgrades only the haproxy package on Debian or Ubuntu; look for the new package version in its output.
sudo apt update && sudo apt install --only-upgrade haproxyThis validates the configuration and, only if it is valid, restarts HAProxy so the patched binary is running. The path /etc/haproxy/haproxy.cfg is the default on Debian and Ubuntu packages; adjust it if your configuration lives elsewhere.
sudo haproxy -c -f /etc/haproxy/haproxy.cfg && sudo systemctl restart haproxy0 of 6 done
Detection and monitoring
No indicators of compromise are published, and nothing in the sources reviewed confirms exploitation in the wild. The GitHub advisories give EPSS estimates of 0.738% for CVE-2026-110353 and 0.807% for CVE-2026-110354 for exploitation within the next 30 days. Treat these as rough probabilities, not confirmation either way.
Symptoms to watch for are sustained high CPU on HAProxy worker threads, slow or failing responses from sites behind the proxy, and CPU that stays pegged after clients disconnect, which matches the behavior described for the chunked-request flaw. This read-only command shows per-thread CPU use of the HAProxy process on Linux.
top -H -p $(pidof -s haproxy)Uptime monitoring helps you spot the user-visible effect of a stalled proxy. Webforta Monitor tracks uptime, certificates and DNS for your sites, and our guide to uptime monitoring explains what to alert on. Monitoring shows the symptom but does not replace patching.
More security news
If you are working through a round of Ubuntu updates, browse the Webforta security blog for other recent notices and advisories.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.