HAProxy Kubernetes Ingress Controller vulnerabilities

Latest HAProxy Kubernetes Ingress Controller CVEs

Newest publication first

1. CVE-2026-110353 haproxy: HAProxy: Denial of Service via truncated HTTP/2 PING frame

   Published 2026-10-22

   High·CVSS 7.5 EPSS 0.74%

   HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomp...

2. CVE-2025-11230 Denial of service vulnerability in HAProxy mjson library

   Published 2025-11-19

   High·CVSS 7.5 EPSS 0.74%

   Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.