The vulnerability is an improper handling of HTTP/2 PING frames, leading to worker‑thread CPU exhaustion. A truncated PING frame is accepted without verifying the read length, causing the multiplexer tasklet to be repeatedly woken without progress. This results in an infinite loop that drains CPU until the connection times out. The weakness aligns with CWE‑252 (Unchecked Return Value) and CWE‑835 (Infinite Loop). The attack can be performed remotely by an unauthenticated attacker sending multiple truncated PING frames, thereby triggering a denial of service due to high CPU usage.

The flaw impacts HAProxy 3.2 and earlier, affecting the standard HAProxy, HAProxy Enterprise Edition, HAProxy Kubernetes Ingress Controller, and the Enterprise edition of the Kubernetes Ingress Controller. Versions prior to 3.4.6 are vulnerable; the issue was patched in 3.4.6 and later releases.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. A remote, unauthenticated attacker can overwhelm the proxy by initiating many connections with incomplete PING frames, which forces the server to spin its worker thread, consuming all CPU resources and degrading or halting service without needing privileged access.