HAProxy on Debian, Oct 2025 to Oct 2026: DSA-6570-1, DLA-4842-1 and earlier denial-of-service fixes

HAProxy sits in front of many web applications, so a bug that makes it spin or crash takes everything behind it down. Between October 2025 and October 2026 Debian published five HAProxy advisories, the latest being DSA-6570-1 for Debian 13 (trixie) and DLA-4842-1 for Debian 12 (bookworm), both on 18 October 2026. Most fix denial of service; one fixes HTTP request smuggling over HTTP/3. Each package includes the earlier fixes.

At a glance

Severity: High, based on CVE-2026-110354 and CVE-2025-11230, both CVSS 3.1 7.5 (remote, unauthenticated denial of service) from their CNAs. None of these CVEs is in CISA's Known Exploited Vulnerabilities catalog (30 Oct 2026).

The advisories

What the vulnerabilities are

• CVE-2025-11230 (JSON). Inefficient parsing of crafted JSON numbers in the bundled mjson code lets a remote attacker exhaust CPU. It matters if your configuration uses HAProxy's JSON converters on request data.
• CVE-2026-110354 (HTTP/1.1 chunked). The CVE record describes a remote, unauthenticated attacker causing persistent CPU exhaustion of a worker thread with a crafted chunked request. When Debian published DSA-6570-1 the CVE IDs were not yet available; the tracker has since attached this one.
• CVE-2026-26081 (QUIC). HAProxy's own news says a specially crafted QUIC packet could crash the process in 3.0 and later; the tracker marks bookworm's 2.6 as not affected.
• CVE-2026-33555 (HTTP/3). The HTTP/3 parser did not check that the body length matched the announced Content-Length, which may allow request smuggling against the backend. Debian notes that these features are not enabled by default in bookworm's packages.

The QUIC and HTTP/3 issues only reach you if you configured QUIC listeners. Check with:

grep -nE 'quic|alpn h3' /etc/haproxy/haproxy.cfg

Are you affected?

apt policy haproxy
haproxy -v

Compare the Installed line with the table. haproxy -v shows the upstream version (3.0.11 or 2.6.12) and does not change with Debian's patches, so rely on apt policy. If you run HAProxy from another repository or a container image, check that source's advisories instead.

How to update

sudo apt update
sudo apt install --only-upgrade haproxy

Before restarting, validate the configuration with the new binary:

sudo haproxy -c -f /etc/haproxy/haproxy.cfg

Restart or reboot?

No reboot. Make sure the running process is the new one: if systemctl show -p ActiveEnterTimestamp haproxy is older than the upgrade, restart it in a quiet period, because a restart drops open connections:

sudo systemctl restart haproxy

With several load balancers, update and restart them one at a time.

Still open

On 31 October 2026 the tracker listed a few further HAProxy CVEs as open with no DSA planned for now, for example CVE-2026-55203 in FastCGI record parsing (relevant if you use FastCGI backends) and CVE-2026-55204 in HTTP/2 header compression. Keep an eye on the page, and keep request limits and timeouts (timeout http-request, maxconn) set so a single client cannot tie up the proxy.

Sources

• security-tracker.debian.org/tracker/DSA-6570-1
• debian.org/security/2026/dsa-6570
• lists.debian.org/debian-security-announce/2026/msg00485.html
• security-tracker.debian.org/tracker/DLA-4842-1
• lists.debian.org/debian-lts-announce/2026/10/msg00036.html
• security-tracker.debian.org/tracker/DSA-6291-1
• lists.debian.org/debian-security-announce/2026/msg00202.html
• security-tracker.debian.org/tracker/DSA-6130-1
• lists.debian.org/debian-security-announce/2026/msg00039.html
• security-tracker.debian.org/tracker/DSA-6017-1
• lists.debian.org/debian-security-announce/2025/msg00183.html
• security-tracker.debian.org/tracker/source-package/haproxy
• security-tracker.debian.org/tracker/CVE-2026-26081
• haproxy.org/news.html
• cve.org/CVERecord?id=CVE-2026-110354
• cve.org/CVERecord?id=CVE-2025-11230
• cve.org/CVERecord?id=CVE-2026-33555
• cve.org/CVERecord?id=CVE-2026-26081
• cisa.gov/known-exploited-vulnerabilities-catalog