Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-110354

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mitre

Description

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

HAProxy HAProxy

Default version status: unaffected

  • 3.0.0 to < 3.0.30affected
  • 3.2.0 to < 3.2.26affected
  • 3.3.0 to < 3.3.17affected
  • 3.4.0 to < 3.4.6affected
  • 3.5-dev to < 3.5-dev9affected

HAProxy HAProxy Enterprise Edition

Default version status: unaffected

  • 3.0r1 to < 3.0r1-362.1441affected
  • 3.2r1 to < 3.2r1-378.1259affected
  • 3.3r1 to < 3.3r1-377.1005affected

HAProxy Technologies HAProxy Kubernetes Ingress Controller

Default version status: unaffected

  • 3.2.0 to < 3.2.17affected

HAProxy Technologies Kubernetes Ingress Controller Enterprise

Default version status: unaffected

  • 3.2.0 to < 3.2.17-ee1affected
  • 3.0 to < 3.0.16-ee17affected
  • 1.11 to < 1.11.14-ee11affected

References