HAProxy EUVD-2026-108001

Exploitation requires that HAProxy be configured with an HTTP/2 frontend (an 'h2' ALPN/listener), since the flaw lives in the H2 multiplexer's PING-frame handler (h2c_handle_ping in src/mux_h2.c); deployments serving only HTTP/1.x are not reachable via this path. No authentication, user interaction, or special privileges are needed against an H2-enabled endpoint, and default configurations that accept HTTP/2 are vulnerable. Limiting factors: the attacker must sustain many concurrent connections to keep CPU elevated because each affected connection is eventually torn down by 'timeout http-request', so connection-rate limiting, per-source connection caps, and short request timeouts materially reduce impact.

This is a genuine but bounded operational risk - a reliability/availability threat, not a compromise vector. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: a remote, unauthenticated attacker can trigger worker-thread CPU exhaustion over the network with low complexity and no user interaction, and the impact is confined to availability (C:N/I:N). No EPSS score, KEV entry, or POC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis' - however, the root cause (a missing short-read check in h2c_handle_ping) is simple and fully described in the public patch commit, lowering the barrier to independent weaponization. The HIGH availability rating should be read in context: this is a CPU-spin/degradation DoS throttled by 'timeout http-request', not a hard crash or memory corruption, and sustaining impact requires many concurrent connections, which rate-limiting or connection caps can blunt. Net: real priority for internet-facing HAProxy with HTTP/2 enabled due to the product's ubiquity and the trivial trigger, but it is a resource-exhaustion issue rather than a code-execution or data-exposure threat, so it ranks below confidentiality/integrity flaws of similar CVSS.

An attacker opens numerous HTTP/2 connections to an internet-facing HAProxy frontend and on each sends a deliberately truncated HTTP/2 PING frame. Because h2c_handle_ping never detects the short read, the pending data is never consumed and the H2 multiplexer tasklet is repeatedly rescheduled without progress, spinning the worker thread's CPU until 'timeout http-request' closes each connection; by churning many such connections the attacker sustains high CPU usage and degrades throughput. No public POC was provided, but the one-line root cause is documented in the patch commit.