CVE-2026-110354
Received
Received - Intake
Denial of Service in HAProxy 3 Before 3.4.6
Vulnerability report for CVE-2026-110354, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-22
Last updated on: 2026-10-22
Assigner: MITRE
Description
Description
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| HAProxy | HAProxy | 3.0.0 |
| HAProxy | HAProxy | 3.2.0 |
| HAProxy | HAProxy | 3.3.0 |
| HAProxy | HAProxy | 3.4.0 |
| HAProxy | HAProxy | 3.5-dev |
| HAProxy | HAProxy | Enterprise Edition 3.0r1 |
| HAProxy | HAProxy | Enterprise Edition 3.2r1 |
| HAProxy | HAProxy | Enterprise Edition 3.3r1 |
| HAProxy | Technologies | HAProxy Kubernetes Ingress Controller 3.2.0 |
| HAProxy | Technologies | Kubernetes Ingress Controller Enterprise 3.2.0 |
| HAProxy | Technologies | Kubernetes Ingress Controller Enterprise 3.0 |
| HAProxy | Technologies | Kubernetes Ingress Controller Enterprise 1.11 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-835 | The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. |
