CVE-2026-110353

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110353
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110353.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110353
Downstream
Related
Published
2026-10-22T02:53:33Z
Modified
2026-11-06T17:27:16Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.

Database specific 
{
    "cna_assigner": "mitre",
    "cwe_ids": [
        "CWE-252"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110353.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "3.2.0"
                        },
                        {
                            "fixed": "3.2.26"
                        },
                        {
                            "introduced": "3.3.0"
                        },
                        {
                            "fixed": "3.3.17"
                        },
                        {
                            "introduced": "3.2.0r1"
                        },
                        {
                            "fixed": "3.2r1-378.1259"
                        },
                        {
                            "introduced": "3.3.0r1"
                        },
                        {
                            "fixed": "3.3r1-377.1005"
                        },
                        {
                            "introduced": "3.2.0"
                        },
                        {
                            "fixed": "3.2.17-ee1"
                        },
                        {
                            "introduced": "3.0"
                        },
                        {
                            "fixed": "3.0.16-ee17"
                        },
                        {
                            "introduced": "1.11"
                        },
                        {
                            "fixed": "1.11.14-ee11"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / git.haproxy.org/git/haproxy.git/

Affected ranges

Type
GIT
Repo
https://git.haproxy.org/git/haproxy.git/
Events
Introduced
64a335366dc1bb5431e28a75e3a22e4226ac9b8f
Fixed
fcfabd0d909afaf379a4e30eb43c5229ddbb9d70
Introduced
7835e1fcbe9208d811e9d89b49e259dad97b6e96
Fixed
37f3ad8aa35bb34b2363b73541780df6c7226270
Introduced
e134140d282c006417945d78e7964cc8fa14586a
Fixed
0ac41ff97e11985ec1cc8f87b7e851c308610d9d
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "3.4.0"
                },
                {
                    "fixed": "3.4.6"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "3.5-dev"
                },
                {
                    "fixed": "3.5-dev9"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "3.2.0"
                },
                {
                    "fixed": "3.2.17"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

v3.*
v3.2.0
v3.3-dev0
v3.3-dev1
v3.3-dev10
v3.3-dev11
v3.3-dev12
v3.3-dev13
v3.3-dev14
v3.3-dev2
v3.3-dev3
v3.3-dev4
v3.3-dev5
v3.3-dev6
v3.3-dev7
v3.3-dev8
v3.3-dev9
v3.3.0
v3.4-dev0
v3.4-dev1
v3.4-dev2
v3.4-dev3
v3.4-dev4
v3.4-dev5
v3.5-dev0
v3.5-dev1
v3.5-dev2
v3.5-dev3
v3.5-dev4
v3.5-dev5
v3.5-dev6
v3.5-dev7
v3.5-dev8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110353.json"