CVE-2026-110354 - Vulnerability Details

- haproxy: haproxy: Denial of Service via specially crafted HTTP/1.1 chunked request

Description

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.

Published: 2026-10-22

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An unauthenticated attacker can send a specially crafted HTTP/1.1 chunked request that causes the HAProxy parser to repeatedly re‑process the same bytes, preventing it from making progress. The affected worker thread remains busy at 100 % CPU after the timeout expires and after the client disconnects, which leads to a persistent denial of service. Repeated requests can consume all worker threads, forcing a full process restart.

Affected Systems

HAProxy Technologies:HAProxy Kubernetes Ingress Controller, HAProxy Technologies:Kubernetes Ingress Controller Enterprise, HAProxy:HAProxy, and HAProxy:HAProxy Enterprise Edition running HAProxy 3 versions earlier than 3.4.6.

Risk and Exploitability

The CVSS score of 7.5 indicates a moderate‑to‑high severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote HTTP request, with no authentication required. An attacker who can connect to the load balancer can repeatedly issue the malformed chunked requests, exhausting worker threads and interrupting service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

HAProxy

unaffected

Version	Status	Constraints
`3.0.0`	affected	< 3.0.30
`3.2.0`	affected	< 3.2.26
`3.3.0`	affected	< 3.3.17
`3.4.0`	affected	< 3.4.6
`3.5-dev`	affected	< 3.5-dev9

HAProxy

HAProxy Enterprise Edition

unaffected

Version	Status	Constraints
`3.0r1`	affected	< 3.0r1-362.1441
`3.2r1`	affected	< 3.2r1-378.1259
`3.3r1`	affected	< 3.3r1-377.1005

HAProxy Technologies

HAProxy Kubernetes Ingress Controller

unaffected

Version	Status	Constraints
`3.2.0`	affected	< 3.2.17

HAProxy Technologies

Kubernetes Ingress Controller Enterprise

unaffected

Version	Status	Constraints
`3.2.0`	affected	< 3.2.17-ee1
`3.0`	affected	< 3.0.16-ee17
`1.11`	affected	< 1.11.14-ee11

No data.

Vendor Product Confidence Versions

Haproxy

100%

Version	Status	Scheme	Platform
`[3.0.0,3.0.30)`	affected	semver	—
`[3.2.0,3.2.26)`	affected	semver	—
`[3.3.0,3.3.17)`	affected	semver	—
`[3.4.0,3.4.6)`	affected	semver	—
`[3.5-dev,3.5-dev9)`	affected	generic	—

Haproxy

Haproxy Enterprise

87%

Version	Status	Scheme	Platform
`[3.0r1,3.0r1-362.1441)`	affected	generic	—
`[3.2r1,3.2r1-378.1259)`	affected	generic	—
`[3.3r1,3.3r1-377.1005)`	affected	generic	—

Haproxy

Kubernetes Ingress Controller

100%

Version	Status	Scheme	Platform
`[3.2.0,3.2.17)`	affected	semver	—

Haproxy

Kubernetes Ingress Controller Enterprise

100%

Version	Status	Scheme	Platform
`[3.2.0,3.2.17-ee1)`	affected	generic	—
`[3.0,3.0.16-ee17)`	affected	generic	—
`[1.11,1.11.14-ee11)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade all HAProxy instances to version 3.4.6 or later for all products, including the Kubernetes Ingress Controller.
If an upgrade cannot be performed immediately, apply request filtering or rate‑limiting to block malformed HTTP/1.1 chunked requests before they reach HAProxy.
Monitor worker thread CPU usage and configure automated alerts or auto‑restarts when sustained high CPU utilization is detected.

Generated by OpenCVE AI on October 22, 2026 at 05:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8972-1	HAProxy vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00807.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://git.haproxy.org/?p=haproxy.git;a=commit;h=077906da140a35873bf451d7e9f67646c9f37c81
https://nvd.nist.gov/vuln/detail/CVE-2026-110354
https://www.cve.org/CVERecord?id=CVE-2026-110354

History

Fri, 23 Oct 2026 00:45:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 22 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Title	Remote Denial of Service via HTTP Chunked Request in HAProxy	haproxy: haproxy: Denial of Service via specially crafted HTTP/1.1 chunked request
References		https://nvd.nist.gov/vuln/detail/CVE-2026-110354 https://www.cve.org/CVERecord?id=CVE-2026-110354
Metrics	threat_severity `None`	threat_severity `Important`

Thu, 22 Oct 2026 11:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Haproxy Haproxy haproxy Haproxy haproxy Enterprise Haproxy kubernetes Ingress Controller Haproxy kubernetes Ingress Controller Enterprise
Vendors & Products		Haproxy Haproxy haproxy Haproxy haproxy Enterprise Haproxy kubernetes Ingress Controller Haproxy kubernetes Ingress Controller Enterprise

Thu, 22 Oct 2026 06:00:00 +0000

Type	Values Removed	Values Added
Title		Remote Denial of Service via HTTP Chunked Request in HAProxy

Thu, 22 Oct 2026 03:00:00 +0000

Type	Values Removed	Values Added
Description		HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
Weaknesses		CWE-835
References		https://git.haproxy.org/?p=haproxy.git;a=commit;h=077906da140a35873bf451d7e9f67646c9f37c81
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Subscriptions

Haproxy Haproxy Haproxy Enterprise Kubernetes Ingress Controller Kubernetes Ingress Controller Enterprise

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2026-10-22T02:46:38.255Z

Updated: 2026-10-22T19:10:34.563Z

Reserved: 2026-10-13T23:22:44.319Z

Link: CVE-2026-110354

Vulnrichment

Updated: 2026-10-22T19:01:03.356Z

NVD

Status : Awaiting Analysis

Published: 2026-10-22T03:16:31.427

Modified: 2026-10-22T19:17:35.660

Link: CVE-2026-110354

Redhat

Severity : Important

Publid Date: 2026-10-22T02:46:38Z

Links: CVE-2026-110354 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-22T10:39:14Z

Weaknesses

CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object