What’s Vulnerable › Vulnerabilities
CVE-2026-110354
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-22 · updated 2026-10-22
- Weakness: CWE-835
Description
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
Affected products
- HAProxy: from 3.0.0 before 3.0.30; from 3.2.0 before 3.2.26; from 3.3.0 before 3.3.17; from 3.4.0 before 3.4.6; from 3.5-dev before 3.5-dev9 — fixed in 3.0.30, 3.2.26, 3.3.17, 3.4.6, 3.5-dev9
- HAProxy Enterprise Edition: from 3.0r1 before 3.0r1-362.1441; from 3.2r1 before 3.2r1-378.1259; from 3.3r1 before 3.3r1-377.1005 — fixed in 3.0r1-362.1441, 3.2r1-378.1259, 3.3r1-377.1005
- HAProxy Technologies HAProxy Kubernetes Ingress Controller: from 3.2.0 before 3.2.17 — fixed in 3.2.17
- Haproxy Kubernetes Ingress Controller Enterprise: from 3.2.0 before 3.2.17-ee1; from 3.0 before 3.0.16-ee17; from 1.11 before 1.11.14-ee11 — fixed in 1.11.14-ee11, 3.0.16-ee17, 3.2.17-ee1
How to fix
Upgrade to a fixed version: HAProxy 3.0.30, 3.2.26, 3.3.17, 3.4.6; HAProxy Enterprise Edition 3.0r1-362.1441, 3.2r1-378.1259, 3.3r1-377.1005; HAProxy Technologies HAProxy Kubernetes Ingress Controller 3.2.17; Haproxy Kubernetes Ingress Controller Enterprise 1.11.14-ee11, 3.0.16-ee17, 3.2.17-ee1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-110354 or the next vulnerability affects your stack