HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1794226157 advisory.

  - HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent     worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the     request before closing the stream, the parser repeatedly re-processes the same bytes without making     progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client     disconnects, and repeated requests can consume all worker threads until the process is restarted.
    (CVE-2026-110354)

  - HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-     thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check     for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed,     its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data     without making progress. The CPU spins until timeout http-request closes the connection, and an attacker     opening many such connections can sustain high CPU usage. (CVE-2026-110353)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8972-1 advisory.

    It was discovered that HAProxy incorrectly handled truncated HTTP/2 PING frames. A remote attacker could     possibly use this issue to cause HAProxy to consume excessive CPU resources, leading to a denial of     service. (CVE-2026-110353)

    It was discovered that HAProxy incorrectly handled certain HTTP/1.1 chunked requests. A remote attacker     could possibly use this issue to cause HAProxy to consume excessive CPU resources, leading to a denial of     service. (CVE-2026-110354)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-     thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check     for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed,     its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data     without making progress. The CPU spins until timeout http-request closes the connection, and an attacker     opening many such connections can sustain high CPU usage. (CVE-2026-110353)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
377677	AlmaLinux 9.2 [TuxCare] Security Update: haproxy Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1794226157)	Nessus	Alma Linux Local Security Checks	Local	high
375780	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : HAProxy vulnerabilities (USN-8972-1)	Nessus	Ubuntu Local Security Checks	Local	high
370533	Linux Distros Unpatched Vulnerability : CVE-2026-110353	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-110353

high

Tenable Plugins

high

high

high