3370 matches found
USN-8972-1: HAProxy vulnerabilities
It was discovered that HAProxy incorrectly handled truncated HTTP/2 PING frames. A remote attacker could possibly use this issue to cause HAProxy to consume excessive CPU resources, leading to a denial of service. CVE-2026-110353 It was discovered that HAProxy incorrectly handled certain HTTP/1.1...
USN-8972-1 haproxy vulnerabilities
It was discovered that HAProxy incorrectly handled truncated HTTP/2 PING frames. A remote attacker could possibly use this issue to cause HAProxy to consume excessive CPU resources, leading to a denial of service. CVE-2026-110353 It was discovered that HAProxy incorrectly handled certain HTTP/1.1...
CLEANSTART-2026-VJ41449 Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service
CVE-2019-9512 affects multiple packages. Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. See references for individual vulnerability details...
CLEANSTART-2024-YV74976 Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service
Security vulnerability affects the go package. Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service...
Moxa MAR-2000 FWR_MAR2000_V1.0_Build_15010909 Scenario Ping Command Injection
Moxa MAR-2000 firmware version FWRMAR2000V1.0Build15010909 contains a command injection in scenario ping conditions. An authenticated administrator can save a crafted parameter that the scheduled PingThread executes through a shell. https://packetstorm.news/download/238064...
EUVD-2026-102321
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering...
Valkey/Redis CVE-2026-25243 Detect
Detects Redis-compatible PING on TCP Valkey module RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Redis-compatible PING on TCP Valkey module RCE chain.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner,...
SUSE CVE-2026-110353
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker-thread CPU exhaustion via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be...
CVE-2026-110353
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker-thread CPU exhaustion via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be...
DEBIAN-CVE-2026-110353
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker-thread CPU exhaustion via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be...
CVE-2026-110353
A flaw was found in HAProxy. A remote, unauthenticated attacker can cause a Denial of Service DoS by sending a truncated HTTP/2 PING frame. Because the server fails to properly validate and process the incomplete frame, the pending data is never consumed, causing worker threads to spin continuous...
CVE-2026-110353
HAProxy versions 3.2 before 3.4.6 are vulnerable to a denial of service (worker-thread CPU exhaustion) due to a flaw in the h2c_handle_ping function within src/mux_h2.c. The root cause is a failure to check for a short read during the processing of truncated HTTP/2 PING frames . This causes the H...
CVE-2026-110353
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker-thread CPU exhaustion via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be...
CVE-2026-110353
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker-thread CPU exhaustion via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be...
EUVD-2026-108001
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker-thread CPU exhaustion via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be...
CVE-2026-110353
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker-thread CPU exhaustion via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be...
CVE-2026-110353
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker-thread CPU exhaustion via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be...
CVE-2026-110353
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker-thread CPU exhaustion via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be...
Improper HAProxy exception handling vulnerability
HAProxy has a vulnerability related to improper exception handling. This vulnerability stems from the lack of validation for short reads in h2chandleping within src/muxh2.c. As a result, truncated HTTP/2 PING frames cannot be processed, and no data is consumed. Consequently, H2 multiplexing tasks...
Linux Distros Unpatched Vulnerability : CVE-2026-110353
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker- thread CPU exhaustion via a truncated HTTP/2 PING frame...