Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-19 | 1 | Disclosure1 |
| 2026-06-23 | 1 | Patch1 |
| 2026-06-29 | 1 | General1 |
CVE-2026-55204 Null Pointer Dereference in HAProxy Through 3.4.0 Causing Denial of Service https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-55204
Post summary
The post announces a null pointer dereference DoS vulnerability (CVE‑2026‑55204) in HAProxy up to 3.4.0, with no evidence of PoC, exploitation, or patch.
『We want to be transparent about that score and equally clear about our assessment: the real-world risk is low. This is not realistically exploitable.』 June 2026 – CVE-2026-55204: null pointer dereference in HAProxy's HPACK header handling https://www.haproxy.com/blog/june-2026-cve-2026-55204-null-pointer-dereference-in-haproxys-hpack-header-handling
Post summary
The passage states that CVE‑2026‑55204, a null pointer dereference in HAProxy’s HPACK handling, presents low real‑world risk and is not realistically exploitable, without providing PoC, exploit, patch, or false‑positive information.
HAProxyに重大(Critical)な脆弱性。CVE-2026-55203はCVSSv4スコア9.0で、FCGIのDemuxレコード長における整数オーバーフロー。hpack_dht_insert関数におけるヌルポインタ参照（CVE-2026-55204、CVSSv4スコア8.7）もあり、それぞれ別コミットで修正。 https://securityonline.info/haproxy-vulnerabilities-cve-2026-55203/
Post summary
HAProxy has two critical CVEs (CVE-2026-55203 and CVE-2026-55204) involving an integer overflow and a null pointer dereference respectively, each fixed in separate commits; a link to more details is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | haproxy | haproxy | - | - | - |