USN-8972-1: Ubuntu patches HAProxy DoS flaws on HTTP/2 and HTTP/1.1

Canonical released security advisory USN-8972-1 on 3 November 2026, addressing two denial-of-service vulnerabilities in HAProxy, the load balancer and reverse proxy deployed across most hosting and CDN infrastructures. Anyone exposing HAProxy in front of public-facing web services must update the package to avoid exposure to specially crafted network traffic.\n\n## The two flaws\n\nThe advisory describes two distinct issues, both remotely exploitable without authentication:\n\nHAProxy was found to handle truncated HTTP/2 PING frames incorrectly. A remote attacker could potentially exploit this issue to cause HAProxy to consume excessive CPU resources, leading to denial of service (CVE-2026-110353). The second issue involves improper handling of certain HTTP/1.1 chunked requests, with the same CPU exhaustion effect (CVE-2026-110354).\n\nFor CVE-2026-110353, the Debian CVE tracker provides technical details: the h2c_handle_ping function in src/mux_h2.c does not verify incomplete reads, unlike other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly awakened without making progress. The CPU spins idle until the http-request timeout expires, and an attacker opening many such connections can sustain high CPU consumption. Affected upstream versions range from 3.2.0 to 3.2.26, 3.3.0 to 3.3.17, and 3.4.0 to 3.4.6, according to the CVE registry consulted. The CVE was published on 22 October 2026, roughly two weeks before the Ubuntu patch.\n\n## Fixed versions\n\n| Ubuntu Release | haproxy package version |\n|---|---|\n| 26.10 | 3.4.2-1ubuntu4.1 |\n| 26.04 LTS | 3.2.25-0ubuntu0.26.04.2 |\n| 24.04 LTS | 2.8.30-0ubuntu0.24.04.2 |\n| 22.04 LTS | 2.4.30-0ubuntu0.22.04.3 |\n\nThe update arrives via standard apt update && apt upgrade on supported releases. Those using Ubuntu Pro receive, as the advisory notes, ten years of security coverage for over 25,000 packages from the Main and Universe repositories, free of charge for up to five machines."