A flaw was found in HAProxy. A remote, unauthenticated attacker can cause a Denial of Service (DoS) by sending a truncated HTTP/2 PING frame. Because the server fails to properly validate and process the incomplete frame, the pending data is never consumed, causing worker threads to spin continuously and exhaust CPU resources. This sustained resource exhaustion can degrade server performance or make the service unresponsive to legitimate users.