Haproxy Enterprise Edition
Monthly
A truncated HTTP/2 PING frame sent to an HAProxy frontend that accepts HTTP/2 causes the H2 multiplexer to spin in a busy loop, driving worker-thread CPU to saturation and degrading or denying service to legitimate traffic (CVSS 7.5, availability-only). Only deployments with an HTTP/2-enabled listener (h2 in the bind line / ALPN negotiation) are reachable; HTTP/1.x-only setups are unaffected, and no authentication or user interaction is required against an H2 endpoint. Sustained impact depends on the attacker holding many concurrent connections open, since each connection is eventually cleared by 'timeout http-request'; no public exploit code was identified at the time of analysis and there is no KEV confirmation of active exploitation.
HAProxy 3.x releases before 3.4.6 can be driven into persistent denial of service by remote unauthenticated attackers sending a single crafted HTTP/1.1 chunked request: the H1 multiplexer's chunk parser re-processes the same bytes without advancing, pinning one worker thread at 100% CPU even after timeouts fire and the client disconnects. Repeating the request exhausts the worker pool until the process is manually restarted, so confidentiality and integrity are unaffected but availability is fully lost. Attack surface is standard HTTP/1.1 frontend traffic (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-835); no public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and the upstream fix commit is published in the HAProxy git repository.
A truncated HTTP/2 PING frame sent to an HAProxy frontend that accepts HTTP/2 causes the H2 multiplexer to spin in a busy loop, driving worker-thread CPU to saturation and degrading or denying service to legitimate traffic (CVSS 7.5, availability-only). Only deployments with an HTTP/2-enabled listener (h2 in the bind line / ALPN negotiation) are reachable; HTTP/1.x-only setups are unaffected, and no authentication or user interaction is required against an H2 endpoint. Sustained impact depends on the attacker holding many concurrent connections open, since each connection is eventually cleared by 'timeout http-request'; no public exploit code was identified at the time of analysis and there is no KEV confirmation of active exploitation.
HAProxy 3.x releases before 3.4.6 can be driven into persistent denial of service by remote unauthenticated attackers sending a single crafted HTTP/1.1 chunked request: the H1 multiplexer's chunk parser re-processes the same bytes without advancing, pinning one worker thread at 100% CPU even after timeouts fire and the client disconnects. Repeating the request exhausts the worker pool until the process is manually restarted, so confidentiality and integrity are unaffected but availability is fully lost. Attack surface is standard HTTP/1.1 frontend traffic (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-835); no public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and the upstream fix commit is published in the HAProxy git repository.