Critical Security Flaw in HAProxy: Denial of Service and Response Smuggling Vulnerabilities
Summary
ALSA-2026:55772: Important: haproxy security update. Affects haproxy versions < 2.8.14-3.el9_8.2. Fixed in 2.8.14-3.el9_8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HAProxy is a widely used open-source software that provides a reliable and high-performance network load balancer for TCP and HTTP-based applications. It is known for its ability to handle a large number of concurrent connections while maintaining low latency. However, recent vulnerabilities have been identified that could potentially compromise the integrity and availability of applications relying on HAProxy.
Vulnerability Detail
The vulnerabilities in HAProxy stem from improper handling of certain data structures. Specifically, CVE-2026-55204 allows for Denial of Service (DoS) attacks through HPACK dynamic table insertions, which can exhaust server resources. Additionally, CVE-2026-55203 involves response smuggling due to an integer overflow in FastCGI record length handling, which can lead to unexpected behavior and data leakage. These vulnerabilities can be exploited by attackers to disrupt service or manipulate responses.
How To Fix
Minimum fixed version
2.8.14-3.el9_8.2
This is the first release that contains the fix.
sudo dnf update haproxyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can implement rate limiting on incoming requests to mitigate the impact of potential DoS attacks. This can be configured in the HAProxy settings by adjusting the 'maxconn' parameter to limit the number of concurrent connections.
Conclusion
The identified vulnerabilities in HAProxy pose significant risks to applications relying on this load balancer. It is crucial for users to update to the latest patched version to mitigate these risks. Implementing temporary workarounds can help reduce exposure until an update is feasible.
See every vulnerability recorded for haproxy →
FAQ
The main vulnerabilities include Denial of Service via HPACK dynamic table insertions (CVE-2026-55204) and response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203).
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing rate limiting to reduce the risk of exploitation until the update can be applied.
The vulnerabilities can lead to service disruptions, data leakage, and potential exploitation by attackers, compromising the security and availability of applications.
More details can be found on the CVE pages for CVE-2026-55203 and CVE-2026-55204, which provide in-depth information about the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for haproxy.
