CVE-2026-55204

Name of the Vulnerable Software and Affected Versions HAProxy versions prior to 3.4.0

Description A null pointer dereference occurs in the hpack dht insert() function within src/hpack-tbl.c because the return value of hpack dht defrag() is not validated when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to cause worker processes to crash, resulting in a denial of service.

Recommendations Update to the version containing commit 9a6d1fe.