Critical Denial of Service Vulnerability in HAProxy Package
Summary
ALSA-2026:55859: Important: haproxy security update. Affects haproxy versions < 1.8.27-5.el8_10.2. Fixed in 1.8.27-5.el8_10.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HAProxy is a widely used open-source software that provides a reliable and high-performance network load balancer for TCP and HTTP-based applications. It is known for its ability to efficiently distribute traffic across multiple servers, ensuring high availability and scalability. However, it is crucial to maintain its security, as vulnerabilities can lead to significant service disruptions.
Vulnerability Detail
The vulnerability identified as CVE-2026-55204 allows for a Denial of Service (DoS) attack through HPACK dynamic table insertions. This means that an attacker could exploit the dynamic table feature of the HPACK compression mechanism used in HTTP/2 to overwhelm the server, potentially leading to service outages. The impact of this vulnerability is severe, as it can disrupt the availability of applications relying on HAProxy for load balancing.
How To Fix
Minimum fixed version
1.8.27-5.el8_10.2
This is the first release that contains the fix.
sudo dnf update haproxyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users may consider limiting the number of concurrent connections or implementing rate limiting on their HAProxy instances to mitigate potential abuse until the package can be updated.
Conclusion
The HAProxy vulnerability CVE-2026-55204 poses a significant risk of Denial of Service attacks, which can disrupt services. It is crucial for users to update to the latest patched version to safeguard their applications. Monitoring tools like Vulert can assist in identifying such vulnerabilities in real-time.
See every vulnerability recorded for haproxy →
FAQ
CVE-2026-55204 is a vulnerability in HAProxy that allows for Denial of Service attacks via HPACK dynamic table insertions.
You can check your HAProxy version by running 'haproxy -v' in your terminal. If it is below 1.8.27-5.el8_10.2, it is affected.
The vulnerability can lead to service outages, making applications reliant on HAProxy unavailable to users.
Yes, tools like Vulert can monitor your software for open-source vulnerabilities in real-time using a manifest file.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for haproxy.
