{"id":"USN-8972-2","summary":"haproxy regression","details":"USN-8972-1 fixed vulnerabilities in HAProxy. On Ubuntu 22.04 LTS, the\nupdate caused a regression when processing certain chunked requests. This\nupdate fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that HAProxy incorrectly handled truncated HTTP/2\n PING frames. A remote attacker could possibly use this issue to cause\n HAProxy to consume excessive CPU resources, leading to a denial of\n service. (CVE-2026-110353)\n\n It was discovered that HAProxy incorrectly handled certain HTTP/1.1\n chunked requests. A remote attacker could possibly use this issue to\n cause HAProxy to consume excessive CPU resources, leading to a denial\n of service. (CVE-2026-110354)","modified":"2026-11-06T01:00:34.369277796Z","published":"2026-11-05T12:52:52Z","references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8972-2"},{"type":"REPORT","url":"https://bugs.launchpad.net/bugs/2172897"}],"affected":[{"package":{"name":"haproxy","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/haproxy?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.30-0ubuntu0.22.04.4"}]}],"versions":["2.2.9-2ubuntu2","2.4.8-1","2.4.8-2ubuntu3","2.4.11-1ubuntu1","2.4.12-1ubuntu1","2.4.12-1ubuntu2","2.4.13-1ubuntu1","2.4.14-1ubuntu1","2.4.18-0ubuntu1","2.4.18-0ubuntu1.1","2.4.18-0ubuntu1.2","2.4.18-0ubuntu1.3","2.4.22-0ubuntu0.22.04.1","2.4.22-0ubuntu0.22.04.2","2.4.22-0ubuntu0.22.04.3","2.4.24-0ubuntu0.22.04.1","2.4.24-0ubuntu0.22.04.2","2.4.24-0ubuntu0.22.04.3","2.4.29-0ubuntu0.22.04.1","2.4.30-0ubuntu0.22.04.1","2.4.30-0ubuntu0.22.04.2","2.4.30-0ubuntu0.22.04.3"],"ecosystem_specific":{"binaries":[{"binary_name":"haproxy","binary_version":"2.4.30-0ubuntu0.22.04.4"},{"binary_name":"vim-haproxy","binary_version":"2.4.30-0ubuntu0.22.04.4"}],"availability":"No subscription required"},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:22.04:LTS","cves":[]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8972-2.json"}}],"schema_version":"1.9.2"}