CVE-2026-55204: HAProxy Null Pointer Dereference Denial of Service Vulnerability

Technical summary

CVE-2026-55204 is a null pointer dereference flaw in HAProxy's HPACK (HTTP/2 header compression) dynamic table implementation. The vulnerability exists in the hpack_dht_insert() function within src/hpack-tbl.c, where the return value of hpack_dht_defrag() is not validated after invocation. When the memory pool is exhausted, hpack_dht_defrag() may return NULL, but the calling code proceeds to dereference this pointer without checking. This occurs during HPACK dynamic table insertions under memory pressure, resulting in a null pointer dereference that crashes the affected worker process. The issue is classified as CWE-476 (Null Pointer Dereference) and affects HAProxy through version 3.4.0, with the fix available in commit 9a6d1fe.

Business impact

This vulnerability enables denial-of-service attacks against HAProxy deployments, directly impacting application availability. Because HAProxy commonly serves as a load balancer or reverse proxy for critical infrastructure, a successful attack can disrupt service to downstream applications and APIs. The attack requires no authentication and can be executed remotely over the network, making it accessible to unauthenticated attackers. While the vulnerability does not enable data theft or system compromise, the availability impact is substantial for organizations relying on HAProxy for traffic distribution or SSL/TLS termination.

Affected systems

HAProxy versions up to and including 3.4.0 are affected. Organizations running HAProxy should verify their deployed version and determine whether they are within the affected range. The fix is available in commit 9a6d1fe and should be incorporated into subsequent stable releases; verify against the vendor advisory for patched version numbers and release dates.

Exploitability

This vulnerability is highly exploitable. The attack has a network vector with low attack complexity, requires no privileges or user interaction, and can be triggered by sending malicious HTTP/2 requests with carefully crafted HPACK dynamic table operations. The attacker does not need any special position or knowledge of the target system beyond network reachability to HAProxy. The primary barrier to exploitation is discovering or crafting the precise sequence of HPACK operations needed to exhaust the memory pool and trigger the null dereference, but this is a solvable reverse-engineering problem. The impact is immediate and visible: worker process crashes and service interruption.

Remediation

Immediate action should focus on upgrading HAProxy to a patched version that includes commit 9a6d1fe or later. Organizations unable to patch immediately should consider implementing network-level controls such as rate-limiting HTTP/2 requests or implementing request filtering to mitigate the memory exhaustion condition that triggers the vulnerability. Load balancing configurations that distribute traffic across multiple HAProxy instances can reduce the impact of individual process crashes, though this does not prevent exploitation. Monitoring for unusual spikes in HAProxy worker process crashes may help detect active exploitation attempts.

Patch guidance

Upgrade HAProxy to a stable release that includes the fix from commit 9a6d1fe. Verify the exact patched version number against the vendor advisory, as patch releases vary by HAProxy release branch. After patching, perform testing in a staging environment to confirm compatibility with your configuration and traffic patterns before deploying to production. Ensure that any custom HAProxy configurations or modules are re-validated following the upgrade.

Detection guidance

Monitor HAProxy logs and worker process exit codes for patterns consistent with crashes or segmentation faults. Enable verbose logging if available to capture details around the time of crashes. On Unix/Linux systems, check system logs (e.g., syslog, dmesg) for core dump or segfault messages associated with HAProxy worker processes. Network-based detection is challenging but possible by monitoring for rapid HTTP/2 requests with repeated or malformed HPACK dynamic table insertions followed by connection drops. Alert on any unexpected loss of HAProxy worker processes or sudden traffic handling degradation.

Why prioritize this

This vulnerability merits urgent attention due to the combination of a CVSS score of 7.5 (HIGH), remote exploitability, no authentication requirement, and direct impact on application availability. HAProxy's role as a critical infrastructure component makes its availability essential. The low barrier to exploitation and the ease of triggering denial of service make this a probable target for opportunistic attackers. Organizations should treat patching this vulnerability as a priority security task.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a HIGH severity rating driven by the network attack vector, low complexity, and high availability impact. The vulnerability does not compromise confidentiality or integrity, which moderates the score below critical levels. However, the complete lack of authentication or user interaction requirements, combined with the immediate and obvious impact (service outage), makes this a practical, high-impact threat in real-world deployments.

Frequently asked questions