CVE-2026-552048.7HighCWE-476
CVE-2026-55204: haproxy vulnerability
Vendor fix available · Affected: haproxy · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
0.5%probability of exploitation in the next 30 days
42nd percentile
050100
Higher than 42% of scored CVEs
8.7HighCVSS 4.0
LowMediumHighCrit.
DescriptionNVD
HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 23 Jun.
- HAProxy flaws enable response smuggling denial of service attacksSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.