CVE 追蹤：基礎設施（代理、DNS、路由、SSH、kernel）

[HIGH 7.5] CVE-2026-110354 — HAProxy

Thu, 22 Oct 2026 19:17:35 +0000

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.

CVSS 3.1：7.5 HIGH（CNA）
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE：CWE-835
比對：HAProxy（關鍵字 ^\s*(In )?HAProxy\b）
NVD 狀態：Awaiting Analysis｜發布 2026-10-22｜最後修改 2026-10-22T19:17

參考連結：

https://git.haproxy.org/?p=haproxy.git;a=commit;h=077906da140a35873bf451d7e9f67646c9f37c81

[HIGH 7.5] CVE-2026-110353 — HAProxy

Thu, 22 Oct 2026 19:17:35 +0000

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.

CVSS 3.1：7.5 HIGH（CNA）
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE：CWE-252
比對：HAProxy（關鍵字 ^\s*(In )?HAProxy\b）
NVD 狀態：Awaiting Analysis｜發布 2026-10-22｜最後修改 2026-10-22T19:17

參考連結：

https://git.haproxy.org/?p=haproxy.git;a=commit;h=cec63e95f62a7412484f1134f5aa227e5b7e1466

[HIGH 7.5] CVE-2026-19630 — BIND

Thu, 22 Oct 2026 17:36:46 +0000

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

CVSS 3.1：7.5 HIGH（CNA）
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE：CWE-407
比對：BIND（關鍵字 (?-i:\bBIND ?9\b)）
NVD 狀態：Awaiting Analysis｜發布 2026-10-21｜最後修改 2026-10-22T17:36

參考連結：

[HIGH 8.1] CVE-2026-94300 — BIND

Thu, 22 Oct 2026 17:36:46 +0000

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

CVSS 3.1：8.1 HIGH（CNA）
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE：CWE-362, CWE-415
比對：BIND（關鍵字 (?-i:\bBIND ?9\b)）
NVD 狀態：Awaiting Analysis｜發布 2026-10-21｜最後修改 2026-10-22T17:36

參考連結：

[HIGH 7.5] CVE-2026-96888 — BIND

Thu, 22 Oct 2026 17:36:46 +0000

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

CVSS 3.1：7.5 HIGH（CNA）
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE：CWE-476, CWE-617
比對：BIND（關鍵字 (?-i:\bBIND ?9\b)）
NVD 狀態：Awaiting Analysis｜發布 2026-10-21｜最後修改 2026-10-22T17:36

參考連結：

[HIGH 7.5] CVE-2026-97313 — BIND

Thu, 22 Oct 2026 17:36:46 +0000

A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

CVSS 3.1：7.5 HIGH（CNA）
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE：CWE-617
比對：BIND（關鍵字 (?-i:\bBIND ?9\b)）
NVD 狀態：Awaiting Analysis｜發布 2026-10-21｜最後修改 2026-10-22T17:36

參考連結：

[CRITICAL 9.1] CVE-2025-31699 — Apache Traffic Server