Remote attackers can trigger a denial‑of‑service condition by sending a truncated HTTP/2 PING frame. The HAProxy 3.2 branch processes the frame in h2c_handle_ping without verifying the frame length, leading to the multiplexer tasklet remaining woken by unprocessed data. This causes the worker thread to spin until the connection times out, draining CPU resources. The impact is a crash or slowdown of the proxy service for all clients using that proxy.

The vulnerability affects HAProxy 3.2 prior to 3.4.6, including the standard HAProxy release, HAProxy Enterprise Edition, HAProxy Kubernetes Ingress Controller, and the Enterprise edition of the Kubernetes Ingress controller.

The CVSS base score of 7.5 reflects a high risk, while no EPSS score is published and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely without authentication by opening many HTTP/2 connections with truncated PING frames, resulting in sustained high CPU usage until the connections are closed by the built‑in timeout logic.