Critical HAProxy Vulnerability: Denial of Service and Response Smuggling Risks
Summary
ALSA-2026:55679: Important: haproxy security update. Affects haproxy versions < 3.0.5-6.el10_2.2. Fixed in 3.0.5-6.el10_2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HAProxy is a widely used open-source software that provides a reliable, high-performance network load balancer for TCP and HTTP-based applications. It is designed to distribute workloads across multiple servers, ensuring high availability and scalability. However, recent vulnerabilities have been identified that could compromise its functionality and security, making it crucial for users to stay informed and take necessary actions.
Vulnerability Detail
The identified vulnerabilities in HAProxy include a Denial of Service (DoS) attack vector via HPACK dynamic table insertions (CVE-2026-55204) and a response smuggling issue caused by an integer overflow in FastCGI record length handling (CVE-2026-55203). These vulnerabilities can lead to service disruptions and unauthorized data manipulation, posing significant risks to applications relying on HAProxy for load balancing.
How To Fix
Minimum fixed version
3.0.5-6.el10_2.2
This is the first release that contains the fix.
sudo dnf update haproxyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of their HAProxy instances by implementing strict input validation and monitoring traffic patterns to detect anomalies. However, this is not a substitute for applying the official patch.
Conclusion
In summary, the recent vulnerabilities in HAProxy pose significant risks that can lead to service disruptions and data integrity issues. It is essential for users to update to the patched version promptly and consider implementing temporary workarounds to mitigate risks until the update can be applied.
See every vulnerability recorded for haproxy →
FAQ
HAProxy is an open-source software that provides high-performance load balancing for TCP and HTTP applications, ensuring efficient distribution of workloads across servers.
The vulnerabilities can lead to Denial of Service attacks and response smuggling, which may disrupt service availability and compromise data integrity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, implement strict input validation and monitor traffic for unusual patterns as a temporary workaround.
For more details, refer to the CVE pages listed in the references section of the security advisory.
Related vulnerabilities
Recent vulnerabilities recorded for haproxy.
