# HAProxy HPACK flaw enables remote DoS

Published: 2026-06-29 · Severity: medium
Canonical: https://vorant.io/reports/ab4ac327-e20b-5dfc-a51d-49ca2602d1c4/haproxy-hpack-flaw-enables-remote-dos

> A null pointer dereference in HAProxy's HPACK header handling allows remote attackers to trigger denial of service across multiple ALOHA and Enterprise versions.

The French CERT has issued an advisory for CVE-2026-55204, a vulnerability in HAProxy that allows remote attackers to cause a denial of service through a null pointer dereference in HPACK header handling. The flaw affects a wide range of HAProxy deployments including ALOHA load balancers and Enterprise editions.

Affected systems include ALOHA versions 14.5.x through 18.0.x, with specific version thresholds requiring updates. Enterprise hapee versions from 2.6r1 through 3.3r1 are also vulnerable. The Community Edition is affected across all versions, with patches forthcoming. Organizations running these versions should prioritize applying the vendor-provided patches to prevent potential service disruptions.

HAProxy is widely deployed in production environments for load balancing and proxying, making this vulnerability significant despite its limitation to denial of service rather than remote code execution. The HPACK protocol is used in HTTP/2 header compression, suggesting the attack vector involves specially crafted HTTP/2 requests.

## Mentioned in this report

- Vulnerabilities: CVE-2026-55204

## Detection guidance (public sample)

### HAProxy Worker Process Crash via Segmentation Fault (Possible HPACK DoS Exploitation)

ATT&CK: T1499

Detects HAProxy process termination with SIGSEGV/core dump generation, consistent with exploitation of the CVE-2026-55204 HPACK null pointer dereference DoS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: HAProxy Worker Crash With Core Dump
id: 3f259772-fec1-5c2a-ad14-8152dfe4741f
status: experimental
description: Detects creation of a core dump file for the haproxy process, which can
  indicate a crash triggered by a malformed HTTP/2 HPACK request exploiting CVE-2026-55204
  (null pointer dereference DoS).
references:
- https://www.cert.ssi.gouv.fr/
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
    - core.haproxy
    - /var/lib/systemd/coredump/core.haproxy
    - /var/crash/haproxy
  condition: selection
falsepositives:
- Legitimate HAProxy crashes caused by unrelated memory bugs, resource exhaustion,
  or misconfiguration
- System-wide coredump testing or debugging activity
level: medium
tags:
- attack.t1499
author: Vorant
```

### HAProxy Service Unexpected Termination via Signal (Possible DoS Exploitation)

ATT&CK: T1499

Detects systemd/journald log entries indicating the haproxy service was killed by a segmentation fault signal, a behavioural indicator of remote DoS exploitation attempts such as CVE-2026-55204. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: HAProxy Service Killed By Signal Indicating Crash
id: 2e31a6a4-92c3-5509-8541-802724507a7b
status: experimental
description: Detects log events showing the haproxy systemd unit exiting due to a
  SIGSEGV or similar fatal signal, which may indicate remote exploitation of an HPACK
  header parsing denial-of-service vulnerability such as CVE-2026-55204. Multiple
  such crashes in a short period should be investigated as a repeated DoS attempt.
references:
- https://www.cert.ssi.gouv.fr/
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
    - 'haproxy.service: Main process exited, code=killed, signal=SEGV'
    - 'haproxy.service: Failed with result'
  condition: selection
falsepositives:
- Unrelated HAProxy crashes from configuration errors or resource exhaustion
- Manual service kills during maintenance or upgrades
level: medium
tags:
- attack.t1499
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0814/

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ab4ac327-e20b-5dfc-a51d-49ca2602d1c4/haproxy-hpack-flaw-enables-remote-dos.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup