Vulnerability · Published Jun 18, 2026 · Assigned by VulnCheck
CVE-2026-55204HAProxy - NULL Pointer Dereference in hpack_dht_insert Function
High 7.5
In plain English
A high-severity null pointer dereference in haproxy from haproxy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | haproxy | 3.0.5-6.el10_2.2 | ALSA-2026:55679 |
| AlmaLinux:8 | haproxy | 1.8.27-5.el8_10.2 | ALSA-2026:55859 |
| AlmaLinux:9 | haproxy | 2.8.14-3.el9_8.2 | ALSA-2026:55772 |
| Debian:12 | haproxy | no fix listed | DEBIAN-CVE-2026-55204 |
| Debian:13 | haproxy | no fix listed | DEBIAN-CVE-2026-55204 |
| Debian:14 | haproxy | 3.2.20-1 | DEBIAN-CVE-2026-55204 |
| Rocky Linux:10 | haproxy | 0:3.0.5-6.el10_2.2 | RLSA-2026:55679 |
| Rocky Linux:8 | haproxy | 0:1.8.27-5.el8_10.2 | RLSA-2026:55859 |
| Rocky Linux:9 | haproxy | 0:2.8.14-3.el9_8.2 | RLSA-2026:55772 |
| Ubuntu:22.04:LTS | haproxy | 2.4.30-0ubuntu0.22.04.2 | UBUNTU-CVE-2026-55204 |
| Ubuntu:24.04:LTS | haproxy | 2.8.16-0ubuntu0.24.04.3 | UBUNTU-CVE-2026-55204 |
| Ubuntu:25.10 | haproxy | 3.0.12-0ubuntu0.25.10.5 | UBUNTU-CVE-2026-55204 |
| Ubuntu:26.04:LTS | haproxy | 3.2.9-1ubuntu2.2 | UBUNTU-CVE-2026-55204 |
Affected products (as reported)
Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H