CVE-2026-93564

Executive Summary

CVE-2026-93564 is a denial-of-service vulnerability in HAProxy's PROXY protocol v2 (PROXY-v2) TLV parsing logic, where a nested-TLV "grandchild" ByteBuf reference is not correctly released, causing a reference-count leak. Because HAProxy is typically deployed as an internet-facing load balancer or reverse proxy terminating client connections, an unauthenticated remote attacker who can reach the proxy protocol parser can drive resource exhaustion over repeated requests, degrading or halting service for all downstream applications. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) with a network attack vector, no privileges or user interaction required, and a full availability impact; no public exploit, PoC, or Nuclei template exists, and no patch is currently available.

Technical Analysis

HAProxy implements two principal connection-level features relevant here: the HTTP/2 protocol (with HPACK-compressed header handling) and the PROXY protocol (versions 1 and 2), which carries client connection metadata between proxy hops. PROXY protocol v2 encodes metadata as a header followed by a sequence of Type-Length-Value (TLV) vectors, and the specification permits certain TLV types to contain nested TLV structures — a "child" TLV nested within a parent, and potentially a "grandchild" TLV nested one level deeper. Each TLV and its contained ByteBuf (the buffer object holding the raw bytes) participates in a reference-counting lifecycle; when parsing completes or an error occurs, the code is expected to release the reference it acquired.

Per the NVD description, the defect is a missing/incorrect release of a ByteBuf reference for a nested-TLV grandchild during PROXY-v2 parsing. The reference count for that buffer object is therefore never decremented back to zero. A ByteBuf whose reference count remains above zero is not returned to the allocation pool, so the underlying memory (and associated bookkeeping) is effectively leaked for the lifetime of the connection or process, depending on the parsing code path.

The description explicitly states this is an incomplete fix of PR #16881. That phrasing implies a prior change was merged to address a reference-count issue in the same nested-TLV parsing area but did not cover the grandchild TLV case — only parent or immediate-child handling was corrected. The remaining unhandled grandchild path is the residual defect now tracked as CVE-2026-93564.

Security consequence: because the leak is driven purely by parsing attacker-influenced input and requires no authentication, no privileges, and no user interaction (AV:N/AC:L/PR:N/UI:N), each crafted PROXY-v2 frame carrying a nested grandchild TLV can increment leaked resources. Sustained or repeated delivery accumulates leaked buffers until memory or connection resources are exhausted, producing a denial of service. The integrity and confidentiality subscores are None (C:N/I:N); the sole impact is to availability (A:H).

No affected version range, commit hash, or patch reference is available in the supplied data, so the precise vulnerable release boundary cannot be stated. Likewise, the exact TLV type identifiers and parser function names are not disclosed and must not be assumed.

Exploitation Scenarios

Note: No public PoC, exploit code, or Nuclei template exists for CVE-2026-93564. The following attack chain is described at the vulnerability-class level and is inferred from the NVD description and the nature of reference-count leaks in PROXY-v2 TLV parsing. No specific function names, TLV type codes, or code paths are asserted because the source description does not provide them.

1. Reconnaissance / target identification. The attacker identifies an HAProxy instance that accepts PROXY protocol v2 headers — i.e., a listener configured with accept-proxy or an equivalent PROXY-v2-enabled bind. Such instances are commonly fronting HTTP/2 or TCP backends in load-balancing tiers. Fingerprinting can be aided by the presence of HAProxy's administrative/stats surface (commonly exposed on a management port), response characteristics, and Shodan-exposed HAProxy products.

2. Triggering the flaw. The attacker establishes connections to the PROXY-v2-enabled listener and sends PROXY protocol v2 headers containing nested TLVs with a grandchild TLV — a malformed or specifically structured encapsulation in which a TLV contains a child TLV that itself contains a grandchild TLV. During parsing of this structure, the code acquires a reference to the grandchild's ByteBuf but, due to the incomplete fix from PR #16881, fails to release it. The parser is reached pre-authentication, so no credentials are required.

3. Execution / amplitude. Each crafted frame leaks one or more ByteBuf references. A single frame may leak a small amount; the attacker amplifies effect through repetition — many connections or many PROXY-v2 frames per connection — causing cumulative leakage. There is no payload delivery or code execution step; the attack is purely a resource-consumption pattern. The attacker needs only to reliably emit the nested grandchild TLV structure.

4. Post-exploitation impact. Accumulated leaked buffers consume process memory and/or connection-tracking resources. Depending on HAProxy's allocation strategy and limits, the observable result is progressive memory growth, degraded throughput/latency, failed new connections, and ultimately process stall or termination (OOM or resource-limit-induced). Recovery typically requires restarting the HAProxy process, which itself causes service interruption — compounding the availability impact aligned with the CVSS A:H subscore.

Because the flaw is in a low-level parser reached on the connection-admission path, it can be triggered without completing TLS/HTTP application-layer exchanges, making it cheap for the attacker relative to the impact.

Impact Assessment

CVSS v3.1: 7.5 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

• Attack Vector — Network (AV:N): Exploitable remotely over the network against any HAProxy listener that parses PROXY-v2 headers.
• Attack Complexity — Low (AC:L): No special conditions, race windows, or target-specific secrets are required; only the ability to send crafted PROXY-v2 nested-TLV frames.
• Privileges Required — None (PR:N): Reached pre-authentication in the connection pipeline.
• User Interaction — None (UI:N): No operator or user action is needed.
• Scope — Unchanged (S:U): Impact is confined to the HAProxy component.
• Confidentiality — None (C:N) / Integrity — None (I:N): No data disclosure or modification is described.
• Availability — High (A:H): The sole and complete impact; sustained leakage can exhaust resources and halt service.

Blast radius. HAProxy frequently sits at the edge of production infrastructure, fronting all downstream applications in its routing table. A denial of service on HAProxy therefore propagates to every backend it serves, making the effective blast radius potentially far larger than the proxy itself — but this is a consequence of topology, not of the CVSS subscores.

Business impact. Loss of availability for all proxied services during an attack; potential cascading failures across dependent tiers; emergency restarts causing additional downtime; increased operational load on SOC and SRE teams. No data-exfiltration or ransomware primitive is provided by this vulnerability.

Exploitability context. EPSS has not been scored by FIRST.org, and the vulnerability is not listed in CISA KEV. No public PoC or exploit code is known. Combined with an unpatched status, this represents a latent risk: low current exploitation likelihood, but a credible, low-complexity attack mechanism if a PoC emerges.

Detection Guidance

Detection for this vulnerability centers on anomalous PROXY-v2 traffic patterns and HAProxy process resource behavior. Because the exact malformed byte patterns are undisclosed, detections focus on (a) PROXY-v2 header anomalies, (b) excessive PROXY-v2 connections from a source, and (c) HAProxy memory growth. These are heuristic detections and should be tuned to the environment.

Sigma Rule

title: HAProxy PROXY-v2 Nested-TLV Leak Activity (CVE-2026-93564)
id: 8f2c1d47-9356-4a1b-9c0e-3d1f7b6a2e50
status: experimental
description: Detects HAProxy logging/errors and abrupt worker terminations consistent with PROXY-v2 nested-TLV reference-count leak causing resource exhaustion.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93564
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1190
  - cve.2026-93564
logsource:
  product: haproxy
  service: http
detection:
  selection_proxyerrors:
    message|contains|all:
      - 'PROXY'
      - 'v2'
    message|contains:
      - 'invalid'
      - 'parse'
      - 'TLV'
      - 'header'
  selection_oom:
    message|contains:
      - 'out of memory'
      - 'failed to allocate'
      - 'proxy out of memory'
      - 'cannot allocate memory'
  selection_workercrash:
    message|contains|all:
      - 'exiting'
    message|contains:
      - 'ABORT'
      - 'signal'
  condition: selection_proxyerrors or selection_oom or selection_workercrash
falsepositives:
  - Legitimate PROXY-v2 clients with malformed-but-benign headers
  - Memory pressure from unrelated workloads
level: medium

YARA Rule

rule CVE_2026_93564_HAProxy_PROXYv2_NestedTLV
{
    meta:
        author      = "valtersit.com"
        description = "Heuristic detection of PROXY protocol v2 frames with nested/possibly grandchild TLV structures (CVE-2026-93564) in captured traffic or payload files"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-93564"
        date        = "2026-01-01"
        severity    = "high"

    strings:
        // PROXY protocol v2 binary signature: \r\n\r\n\0\r\nQUIT\n as bytes
        $ppv2_sig = { 0D 0A 0D 0A 00 0D 0A 51 55 49 54 0A }

    condition:
        $ppv2_sig at 0
}

Note: The exact nested-TLV byte sequences are not published. This rule anchors on the documented PROXY-v2 signature; it can be combined with stream reassembly and length heuristics in a traffic analysis pipeline to flag frames exceeding expected TLV nesting depth.

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-93564 Possible HAProxy PROXY-v2 Nested-TLV Leak (excessive PROXY headers)"; flow:established,to_server; content:"|0D 0A 0D 0A 00 0D 0A 51 55 49 54 0A|"; depth:12; threshold:type both, track by_src, count 100, seconds 60; classtype:attempted-dos; reference:cve,2026-93564; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-93564; sid:202693564; rev:1;)

Rationale: The rule matches repeated PROXY-v2 signatures from a single source within a short window — a pattern consistent with the amplification-by-repetition technique required to convert a per-frame reference leak into a service-impacting exhaustion.

Elastic Detection

sequence by source.ip with maxspan=60s
  [ network where network.transport == "tcp" and
    process.name == "haproxy" ]
  [ network where network.transport == "tcp" and
    process.name == "haproxy" ]
| where count >= 50

Description: Uses an aggregation over HAProxy network events to surface sources generating abnormal numbers of PROXY-v2 connection attempts. If ECS events include haproxy.* fields (e.g., error fields), add and haproxy.error != null filters. This is a behavioral threshold detection, not a signature match.

Splunk SPL Query

index=proxy sourcetype=haproxy
| eval is_proxy_v2_error = if(match(_raw, "(?i)PROXY.*v2") AND (match(_raw, "(?i)invalid|parse|TLV|too long|malformed")), 1, 0)
| eval is_oom = if(match(_raw, "(?i)out of memory|cannot allocate|failed to allocate|proxy out of memory"), 1, 0)
| where is_proxy_v2_error=1 OR is_oom=1
| stats count as events, dc(src) as srcs, values(src) as sources by host
| where events >= 20
| sort - events

Description: Correlates HAProxy log entries indicating PROXY-v2 parsing anomalies or memory-allocation failures, grouped by host, to identify instances under repeated malformed-PROXY-v2 pressure. Adjust index/sourcetype to the environment's HAProxy log onboarding.

Wazuh OSSEC Rule

<group name="haproxy,cve-2026-93564,">
  <rule id="2026935" level="8">
    <decoded_as>haproxy</decoded_as>
    <match>PROXY</match>
    <regex type="pcre2">(?i)(invalid|parse|TLV|malformed).*?v2</regex>
    <description>HAProxy: possible PROXY-v2 malformed/TLV parsing activity (CVE-2026-93564)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="2026936" level="12">
    <decoded_as>haproxy</decoded_as>
    <match>out of memory|cannot allocate memory|failed to allocate</match>
    <description>HAProxy: memory allocation failure - possible resource exhaustion (CVE-2026-93564)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="2026937" level="13" frequency="10" timeframe="60">
    <if_matched_sid>2026935</if_matched_sid>
    <same_source_ip />
    <description>HAProxy: repeated PROXY-v2 malformed parsing from same source (possible CVE-2026-93564 abuse)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. No vendor fix, workaround, or affected-version list is available. The CVE is described as an incomplete fix of PR #16881, but the completing change has not been published in the supplied data. CISA KEV: No.

1) Immediate mitigations (no vendor patch available):

• Disable PROXY-v2 where not required. If a listener does not genuinely need accept-proxy / PROXY protocol v2, remove it from the bind configuration. Removing the parser from the exposure path eliminates the trigger surface.
• Restrict reachability of PROXY-v2-enabled listeners. Enforce network ACLs, firewall rules, or security groups so that only trusted upstream proxies/load balancers can connect to PROXY-v2 ports. This prevents arbitrary internet clients from reaching the parser.
• Terminate PROXY-v2 at trusted, network-isolated hops only, and never expose accept-proxy binds directly to untrusted networks.
• Cap blast radius with resource limits. Apply HAProxy's per-process memory and connection limits (maxconn, memory/ulimit controls) and configure automatic worker recycling so that leaked buffers are reclaimed on rotation before exhaustion. Configure alerting on RSS growth.
• Rate-limit and connection-limit untrusted sources at the edge (upstream firewall/WAF) to blunt the repetition-based amplification.
• Protect the stats/admin socket/port: bind it to loopback or a management network and require authentication; do not expose port 8404 publicly.

2) Patch/upgrade steps:

• Monitor the HAProxy project's security advisories and release notes and the upstream PR #16881 discussion for a follow-up commit that completes nested-TLV grandchild reference handling.
• Because no fixed version is currently identified, do not attempt to "upgrade to a fixed version" until the vendor publishes one. Track CVE-2026-93564 in the NVD and the HAProxy security channels.
• If a vendor patch becomes available, validate it in a staging environment (confirm the exact affected range declared by the vendor, then upgrade to the fixed release across all edge instances) before fleet rollout.

3) Long-term hardening:

• Maintain a documented inventory of every PROXY-v2-enabled listener and treat each as an elevated-exposure component.
• Adopt memory-leak regression testing for connection-parser changes, including nested-extensible-format (TLV) parsers, as part of the CI pipeline.
• Enable continuous RSS/heap monitoring with automated alerting on monotonic growth in HAProxy workers.
• Practice least-exposure architecture: PROXY protocol is a trust-boundary feature and should only be consumed from authenticated, network-segmented peers.
• Track EPSS and CISA KEV for status changes; re-prioritize patching if a public PoC or in-the-wild exploitation emerges.

References

1. NVD — CVE-2026-93564: https://nvd.nist.gov/vuln/detail/CVE-2026-93564 — canonical record; CNA title and description (PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak; incomplete fix of PR #16881); CVSS 3.1 7.5; CWE-1035.
2. HAProxy upstream project (PR #16881 discussion and release notes): https://github.com/haproxy/haproxy — consult the referenced pull request and subsequent security commits/advisories for the completing fix. (No fixed version confirmed in tracked data.)
3. HAProxy Security / Mailing List & Release Notes: https://www.mail-archive.com/haproxy@formilux.org/ and https://www.haproxy.org/ — vendor channels where a completed fix and advisory would be published.
4. CWE-1035 — OWASP Top Ten 2017 Category A9 mapping (per CWE database): https://cwe.mitre.org/data/definitions/1035.html — categorization context for the vulnerability class.
5. FIRST EPSS: https://www.first.org/epss/ — EPSS not yet scored for CVE-2026-93564 as of this report; recheck for updates.
6. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-93564 is not listed as of this report.

Threat actor / exploit-in-the-wild evidence: None. No public PoC, exploit code, Nuclei template, or evidence of active exploitation exists for CVE-2026-93564. No associated threat actor campaigns are known. The vulnerability is unpatched, so proactive monitoring for a completing vendor fix and for any emerging PoC is recommended.

Report generated for valtersit.com. All technical claims are derived strictly from the supplied CVE intelligence. Where source data was sparse (affected versions, patch references, exact TLV structures), limitations are stated explicitly rather than filled with inferred detail.