# CVE-2026-55204: HAProxy NULL pointer dereference in hpack_dht_insert

Source: https://junglewise.ai/threats/cve-2026-55204-haproxy-null-pointer-dereference-in-hpack-dht-insert  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-55204 · Severity: high · CVSS 7.5 · Published 2026-06-18

HAProxy is a widely used load balancer and proxy server that manages web traffic for high-availability environments. A flaw in how it handles compressed web headers can allow a remote attacker to crash the service by sending specific requests during periods of high memory usage. This results in a denial-of-service (DoS) condition, potentially taking websites or applications offline.

Technologies: [HAProxy](https://junglewise.ai/threats/technologies/haproxy). Vendors: [HAProxy](https://junglewise.ai/threats/vendors/haproxy).

## Quick answers

**Is CVE-2026-55204 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55204 being exploited in the wild.

**How severe is CVE-2026-55204?** High severity, with a CVSS score of 7.5, published 18 June 2026.

**Which products and versions are affected?** HAProxy Up to and including 3.4.0.

**Is there a fix for CVE-2026-55204?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-55204 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-55204?** Check whether you run HAProxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A NULL pointer dereference exists in the hpack_dht_insert() function within src/hpack-tbl.c. The vulnerability occurs because the code fails to validate the return value of hpack_dht_defrag() when the memory pool (pool_head_hpack_tbl) is exhausted. An attacker can exploit this by triggering HPACK dynamic table insertions under memory pressure, leading the application to dereference a NULL pointer plus an offset. This results in a SIGSEGV and a crash of the HAProxy worker process. The issue is fixed in commit 9a6d1fe and affects versions through 3.4.0.

## Affected products

- HAProxy HAProxy Up to and including 3.4.0

## Timeline

- 2026-06-18: disclosed
- 2026-06-18: advisory

## References

- [https://github.com/haproxy/haproxy/commit/9a6d1fe3f00d86ab4ea6ea6ea0a5d48fc058a513](https://github.com/haproxy/haproxy/commit/9a6d1fe3f00d86ab4ea6ea6ea0a5d48fc058a513)
- [https://www.vulncheck.com/advisories/haproxy-null-pointer-dereference-in-hpack-dht-insert-function](https://www.vulncheck.com/advisories/haproxy-null-pointer-dereference-in-hpack-dht-insert-function)

## Related threats

- [HAProxy denial of service in HTTP/1.1 chunked request parsing](https://junglewise.ai/threats/cve-2026-110354-haproxy-3-before-3-4-6-allows-a-remote-unauthenticated-attacker)
- [HAProxy denial of service via truncated HTTP/2 PING frame](https://junglewise.ai/threats/cve-2026-110353-haproxy-3-2-before-3-4-6-allows-a-remote-unauthenticated)
- [HAProxy HTTP request smuggling in HTTP/3 multiplexer](https://junglewise.ai/threats/cve-2026-90678-haproxy-http-request-smuggling-in-http-3-multiplexer)
- [HAProxy integer overflow in FCGI demultiplexer](https://junglewise.ai/threats/cve-2026-55203-haproxy-integer-overflow-in-fcgi-demultiplexer)
- [HAProxy request smuggling via HTTP/3 standalone FIN desynchronization](https://junglewise.ai/threats/cve-2026-33555-haproxy-request-smuggling-via-http-3-standalone-fin)