HAProxy Enterprise Edition vulnerabilities

2 known vulnerabilities in HAProxy Enterprise Edition from Haproxy. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  HAProxy: Loop with Unreachable Exit Condition

  CVE-2026-110354Oct 22, 2026Haproxy

  HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeate

• 7.5 High severity

  HAProxy: Unchecked Return Value

  CVE-2026-110353Oct 22, 2026Haproxy

  HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers