CVE-2026-110353: HAProxy is affected by a denial-of-service flaw. A remote unauthenticated attacker can send truncated HTTP/2 PING frames to drive worker-thread CPU to exhaustion.
Affected versions span 3.2.0 through 3.4.5. No exploitation has been confirmed.
The fix ships in HAProxy 3.2.26, 3.3.17, 3.4.6, and later.