{"schemaVersion":3,"id":"USN-8459-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"haproxy vulnerabilities\n\nIt was discovered that HAProxy incorrectly handled the FCGI demultiplexer\nrecord length field. A remote attacker could possibly use this issue to\ncause incorrect request routing, response smuggling, or other memory safety\nissues. (CVE-2026-55203)\n\nIt was discovered that HAProxy failed to validate the return value of the\nHPACK dynamic table defragmentation function when memory was exhausted. A\nremote attacker could possibly use this issue to cause HAProxy to crash,\nresulting in a denial of service. (CVE-2026-55204)","dates":{"published":"2026-06-22T13:55:06.000Z","modified":"2026-06-29T13:51:19.486Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"haproxy","name":"haproxy","label":"haproxy","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/haproxy","purlType":"deb","versions":[{"text":"< 2.4.30-0ubuntu0.22.04.2","noFixRecorded":false,"fixedIn":null},{"text":"< 2.8.16-0ubuntu0.24.04.3","noFixRecorded":false,"fixedIn":null},{"text":"< 3.0.12-0ubuntu0.25.10.5","noFixRecorded":false,"fixedIn":null},{"text":"< 3.2.9-1ubuntu2.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.30-0ubuntu0.22.04.2 | < 2.8.16-0ubuntu0.24.04.3 | < 3.0.12-0ubuntu0.25.10.5 | < 3.2.9-1ubuntu2.2","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-8459-1","label":"ubuntu.com/security/notices/USN-8459-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-55203","label":"ubuntu.com/security/CVE-2026-55203","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-55204","label":"ubuntu.com/security/CVE-2026-55204","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CVE-2026-55203","CVE-2026-55204"]},"timeline":[{"kind":"published","date":"2026-06-22T13:55:06.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-29T13:51:19.486Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T00:35:04.580Z","stale":false,"partial":false}}