CVE-2026-55204: 
HAProxy vulnerability analysis and mitigation

CVE-2026-55204 is a NULL pointer dereference vulnerability in HAProxy's HPACK dynamic table handling that allows unauthenticated remote attackers to crash HAProxy worker processes, causing denial of service. It affects HAProxy through version 3.4.0 (including the Aloha appliance product line) and was disclosed on June 18, 2026, with a fix committed as commit 9a6d1fe. The vulnerability carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, Feedly).

The root cause is a missing NULL check in hpack_dht_insert() within src/hpack-tbl.c (CWE-476: NULL Pointer Dereference). The function calls hpack_dht_defrag() at three locations; two of them (lines 293 and 306) correctly validate the return value, but the third call site (line 353, the data-space defrag path) assigns the return value to dht and immediately dereferences it without a NULL check. When the pool_head_hpack_tbl memory pool is exhausted, hpack_dht_alloc() returns NULL, which propagates through hpack_dht_defrag(), and the subsequent dereference of NULL+0x0a (an offsetof wrap) triggers a SIGSEGV, crashing the worker process. An attacker exploits this by sending HTTP/2 requests that trigger HPACK dynamic table insertions under memory pressure conditions (HAProxy Commit, GitHub Advisory).

Successful exploitation results in a crash of HAProxy worker processes via SIGSEGV, causing a denial of service for all traffic proxied through the affected instance. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. In environments without automatic worker restart or redundant HAProxy instances, exploitation could result in complete service outage for dependent applications (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing HAProxy instances running version 3.4.0 or earlier using tools like Shodan or Censys, filtering for HTTP/2-enabled services.
2. Establish HTTP/2 connection: Connect to the target HAProxy instance using an HTTP/2-capable client (e.g., curl --http2, h2load, or a custom script using nghttp2).
3. Trigger memory pressure: Send a high volume of HTTP/2 requests with large or numerous custom headers to exhaust the pool_head_hpack_tbl memory pool on the HAProxy worker process.
4. Trigger HPACK dynamic table insertion: Craft HTTP/2 requests that cause HPACK dynamic table insertions (e.g., sending headers not previously seen, forcing the HPACK encoder/decoder to add entries to the dynamic table) while the memory pool is under pressure.
5. Induce NULL dereference: When hpack_dht_defrag() returns NULL due to pool exhaustion and the unguarded code path at line 353 of src/hpack-tbl.c dereferences it, the worker process crashes with SIGSEGV, causing denial of service (HAProxy Commit, GitHub Advisory).

• Logs: HAProxy error logs showing worker process crashes with SIGSEGV signals; repeated [ALERT] or [WARNING] entries indicating worker restarts; entries referencing hpack-tbl.c or HPACK-related errors.
• Process: Unexpected termination and restart of HAProxy worker processes (haproxy child processes); core dump files generated in the HAProxy working directory following SIGSEGV.
• Network: Anomalous spikes in HTTP/2 traffic volume from a single or small set of source IPs; high rates of HTTP/2 connections with large or unusual header sets targeting the HAProxy frontend.

The fix is available in HAProxy commit 9a6d1fe3f00d86ab4ea6ea6ea0a5d48fc058a513, which adds the missing NULL check after hpack_dht_defrag(). Users should upgrade to a patched HAProxy build containing this commit; the HAProxy maintainers noted it must be backported to all stable versions. As interim mitigations, operators can implement network-level rate limiting on HTTP/2 traffic to reduce the ability to trigger frequent HPACK dynamic table insertions, and configure automatic restart mechanisms for failed worker processes to minimize downtime. Ubuntu (USN-8459-1) and SUSE (SUSE-SU-2026:2652-1) have released updated packages (HAProxy Commit, SUSE Advisory).

HAProxy published an official blog post detailing the vulnerability and its fix (HAProxy Blog). The vulnerability was reported by researcher Tristan (@TristanInSec), as credited in the commit message. Security news outlet SecurityOnline.info covered the issue alongside a related HAProxy CVE (CVE-2026-55203). Linux distribution vendors including Ubuntu, SUSE, and openSUSE promptly issued security advisories and updated packages.