{"id":"CVE-2026-55204","summary":"HAProxy - NULL Pointer Dereference in hpack_dht_insert Function","details":"HAProxy through  3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.","aliases":["BIT-haproxy-2026-55204"],"modified":"2026-11-04T07:22:46.255075852Z","published":"2026-06-18T16:05:52.058Z","related":["ALSA-2026:55679","ALSA-2026:55772","ALSA-2026:55859","SUSE-SU-2026:22515-1","SUSE-SU-2026:22544-1","SUSE-SU-2026:22557-1","SUSE-SU-2026:22587-1","SUSE-SU-2026:22663-1","SUSE-SU-2026:2651-1","SUSE-SU-2026:2652-1","openSUSE-SU-2026:11090-1","openSUSE-SU-2026:21245-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55204.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-476"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55204.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55204"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/haproxy-null-pointer-dereference-in-hpack-dht-insert-function"},{"type":"FIX","url":"https://github.com/haproxy/haproxy/commit/9a6d1fe3f00d86ab4ea6ea6ea0a5d48fc058a513"},{"type":"PACKAGE","url":"https://github.com/haproxy/haproxy"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/haproxy/haproxy","events":[{"introduced":"7832fb21fe2dd11ce44e996d8e86802731b871b2"},{"fixed":"aed953088ebfdf6046e4a8d362f97d391c5793b4"},{"fixed":"9a6d1fe3f00d86ab4ea6ea6ea0a5d48fc058a513"}],"database_specific":{"extracted_events":[{"source":"CPE_RANGE","cpe":"cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*","range":[{"introduced":"3.3"},{"fixed":"3.4.1"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"9a6d1fe3f00d86ab4ea6ea6ea0a5d48fc058a513"}]}]}}],"versions":["v3.4-dev0","v3.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55204.json","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/haproxy/haproxy/commit/9a6d1fe3f00d86ab4ea6ea6ea0a5d48fc058a513","target":{"file":"src/hpack-tbl.c","function":"hpack_dht_insert"},"deprecated":false,"digest":{"function_hash":"338751424987132939024747892497198054148","length":2455},"id":"CVE-2026-55204-0d78daeb"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["40908380705076211766954459725958104","264508472132916529779782027168019563567","7199169709347451960990779938033903923","211161776252394108731142819930810131911"]},"id":"CVE-2026-55204-4609dae9","signature_type":"Line","signature_version":"v1","source":"https://github.com/haproxy/haproxy/commit/9a6d1fe3f00d86ab4ea6ea6ea0a5d48fc058a513","target":{"file":"src/hpack-tbl.c"}}],"vanir_signatures_modified":"2026-11-04T07:22:46Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}