CVE-2026-110354
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
| CWE | CWE-835 |
| Vendor | haproxy |
| Product | haproxy |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for haproxy haproxy
Be the first to know when new high vulnerabilities affecting haproxy haproxy are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
HAProxy / HAProxy
3.0.0 < 3.0.30 3.2.0 < 3.2.26 3.3.0 < 3.3.17 3.4.0 < 3.4.6 3.5-dev < 3.5-dev9
HAProxy / HAProxy Enterprise Edition
3.0r1 < 3.0r1-362.1441 3.2r1 < 3.2r1-378.1259 3.3r1 < 3.3r1-377.1005
HAProxy Technologies / HAProxy Kubernetes Ingress Controller
3.2.0 < 3.2.17
HAProxy Technologies / Kubernetes Ingress Controller Enterprise
3.2.0 < 3.2.17-ee1 3.0 < 3.0.16-ee17 1.11 < 1.11.14-ee11