HAProxy HPACK flaw enables remote DoS
A null pointer dereference in HAProxy's HPACK header handling allows remote attackers to trigger denial of service across multiple ALOHA and Enterprise versions.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
The French CERT has issued an advisory for CVE-2026-55204, a vulnerability in HAProxy that allows remote attackers to cause a denial of service through a null pointer dereference in HPACK header handling. The flaw affects a wide range of HAProxy deployments including ALOHA load balancers and Enterprise editions.
Affected systems include ALOHA versions 14.5.x through 18.0.x, with specific version thresholds requiring updates. Enterprise hapee versions from 2.6r1 through 3.3r1 are also vulnerable. The Community Edition is affected across all versions, with patches forthcoming. Organizations running these versions should prioritize applying the vendor-provided patches to prevent potential service disruptions.
HAProxy is widely deployed in production environments for load balancing and proxying, making this vulnerability significant despite its limitation to denial of service rather than remote code execution. The HPACK protocol is used in HTTP/2 header compression, suggesting the attack vector involves specially crafted HTTP/2 requests.
Mentioned in this report
Detection guidance
HAProxy Worker Process Crash via Segmentation Fault (Possible HPACK DoS Exploitation)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HAProxy process termination with SIGSEGV/core dump generation, consistent with exploitation of the CVE-2026-55204 HPACK null pointer dereference DoS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: HAProxy Worker Crash With Core Dump
id: 3f259772-fec1-5c2a-ad14-8152dfe4741f
status: experimental
description: Detects creation of a core dump file for the haproxy process, which can
indicate a crash triggered by a malformed HTTP/2 HPACK request exploiting CVE-2026-55204
(null pointer dereference DoS).
references:
- https://www.cert.ssi.gouv.fr/
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|contains:
- core.haproxy
- /var/lib/systemd/coredump/core.haproxy
- /var/crash/haproxy
condition: selection
falsepositives:
- Legitimate HAProxy crashes caused by unrelated memory bugs, resource exhaustion,
or misconfiguration
- System-wide coredump testing or debugging activity
level: medium
tags:
- attack.t1499
author: Vorant
HAProxy Service Unexpected Termination via Signal (Possible DoS Exploitation)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects systemd/journald log entries indicating the haproxy service was killed by a segmentation fault signal, a behavioural indicator of remote DoS exploitation attempts such as CVE-2026-55204. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: HAProxy Service Killed By Signal Indicating Crash
id: 2e31a6a4-92c3-5509-8541-802724507a7b
status: experimental
description: Detects log events showing the haproxy systemd unit exiting due to a
SIGSEGV or similar fatal signal, which may indicate remote exploitation of an HPACK
header parsing denial-of-service vulnerability such as CVE-2026-55204. Multiple
such crashes in a short period should be investigated as a repeated DoS attempt.
references:
- https://www.cert.ssi.gouv.fr/
logsource:
category: process_creation
product: linux
detection:
selection:
CommandLine|contains:
- 'haproxy.service: Main process exited, code=killed, signal=SEGV'
- 'haproxy.service: Failed with result'
condition: selection
falsepositives:
- Unrelated HAProxy crashes from configuration errors or resource exhaustion
- Manual service kills during maintenance or upgrades
level: medium
tags:
- attack.t1499
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0814/
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs