Null Pointer Dereference Vulnerability in HAProxy by HAProxy Technologies

CVE-2026-55204

What is CVE-2026-55204?

HAProxy, up to version 3.4.0, is susceptible to a null pointer dereference vulnerability within the hpack_dht_insert() function located in src/hpack-tbl.c. This issue arises when the function fails to validate the return value of hpack_dht_defrag() during scenarios of memory exhaustion. An attacker can exploit this by forcing dynamic table insertions under significant memory pressure, resulting in the dereferencing of a NULL pointer. This flaw can lead to the crash of HAProxy worker processes, ultimately causing a denial of service, disrupting service availability.

References