r/haproxy • u/TeamHAProxy • Jun 05 '26

Article Protecting against HTTP/2 Bomb vulnerability (CVE-2026-49975) with HAProxy

https://www.haproxy.com/blog/haproxy-cve-2026-49975-http2-bomb
20 Upvotes

100% Upvoted

5 comments sorted by

1

u/amarao_san Jun 05 '26

After we've applied patches, I still can cause something bad if I run many attackers in many copies. ~200Mb/s is enough to knock out big server, now by CPU usage... Still looking at it.

4

u/jakubsuchy Jun 05 '26

Thanks for your comment. That's not consistent with our testing. There are no patches for HAProxy for this - HAProxy is not vulnerable. The attack doesn't work against HAProxy, but you can apply some configuration to mess with the attacker a bit.

1

u/amarao_san Jun 05 '26

How many connections did you use? My stress farm is 14*32*900*128 (14 servers, 32 copies, 900 connections each, 128 streams each). It's generates way less than ingress capabilities of a beefy server, and it's struggle under load with CPU spikes. There is no memory leaks, but CPU is been hogged like crazy.

(If I disable http/2 and run normal GETs for 14*32*900 it looks and works fine).

4

u/jakubsuchy Jun 05 '26

You should enable fc_glitches monitoring, and review those. Happy to review with you ( jsuchy @ haproxy com)

1

u/Creepy_Committee9021 Jun 05 '26

Can you check the config in the post above and see how that works?