CVE-2026-110354
High 7.5
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
Assigner
mitre
mitre
Published
2026-10-22
2026-10-22
Updated
2026-10-22
2026-10-22
Reserved
2026-10-13
2026-10-13
Scores
| Source | CVSS | Score | Severity | Vector |
|---|---|---|---|---|
| mitre | 3.1 | 7.5 | High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Weaknesses
Affected
| Vendor | Product | Versions |
|---|---|---|
| HAProxy | HAProxy | 3.0.0 to < 3.0.30 (affected) 3.2.0 to < 3.2.26 (affected) 3.3.0 to < 3.3.17 (affected) 3.4.0 to < 3.4.6 (affected) 3.5-dev to < 3.5-dev9 (affected) others: unaffected |
| HAProxy | HAProxy Enterprise Edition | 3.0r1 to < 3.0r1-362.1441 (affected) 3.2r1 to < 3.2r1-378.1259 (affected) 3.3r1 to < 3.3r1-377.1005 (affected) others: unaffected |
| HAProxy Technologies | HAProxy Kubernetes Ingress Controller | 3.2.0 to < 3.2.17 (affected)
others: unaffected |
| HAProxy Technologies | Kubernetes Ingress Controller Enterprise | 3.2.0 to < 3.2.17-ee1 (affected) 3.0 to < 3.0.16-ee17 (affected) 1.11 to < 1.11.14-ee11 (affected) others: unaffected |
References
- https://git.haproxy.org/?p=haproxy.git;a=commit;h=077906da140a35873bf451d7e9f67646c9f37c81 vendor-advisory
Full CVE JSON record (5.2)
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"mux-h1"
],
"product": "HAProxy",
"programFiles": [
"src/h1_htx.c"
],
"programRoutines": [
{
"name": "h1_parse_msg_data"
}
],
"repo": "https://git.haproxy.org/git/haproxy.git",
"vendor": "HAProxy",
"versions": [
{
"lessThan": "3.0.30",
"status": "affected",
"version": "3.0.0",
"versionType": "custom"
},
{
"lessThan": "3.2.26",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.3.17",
"status": "affected",
"version": "3.3.0",
"versionType": "custom"
},
{
"lessThan": "3.4.6",
"status": "affected",
"version": "3.4.0",
"versionType": "custom"
},
{
"lessThan": "3.5-dev9",
"status": "affected",
"version": "3.5-dev",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HAProxy Enterprise Edition",
"vendor": "HAProxy",
"versions": [
{
"lessThan": "3.0r1-362.1441",
"status": "affected",
"version": "3.0r1",
"versionType": "custom"
},
{
"lessThan": "3.2r1-378.1259",
"status": "affected",
"version": "3.2r1",
"versionType": "custom"
},
{
"lessThan": "3.3r1-377.1005",
"status": "affected",
"version": "3.3r1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HAProxy Kubernetes Ingress Controller",
"vendor": "HAProxy Technologies",
"versions": [
{
"lessThan": "3.2.17",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Kubernetes Ingress Controller Enterprise",
"vendor": "HAProxy Technologies",
"versions": [
{
"lessThan": "3.2.17-ee1",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.0.16-ee17",
"status": "affected",
"version": "3.0",
"versionType": "custom"
},
{
"lessThan": "1.11.14-ee11",
"status": "affected",
"version": "1.11",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T02:46:38.255Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://git.haproxy.org/?p=haproxy.git;a=commit;h=077906da140a35873bf451d7e9f67646c9f37c81"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-110354",
"datePublished": "2026-10-22T02:46:38.255Z",
"dateReserved": "2026-10-13T23:22:44.319Z",
"dateUpdated": "2026-10-22T02:46:38.255Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}