Description
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
Published: 2026-10-22
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Denial of Service via persistent worker-thread CPU exhaustion
Action: Immediate Patch
AI Analysis

Impact

An unauthenticated attacker can send a specially crafted HTTP/1.1 chunked request that causes the HAProxy parser to repeatedly re‑process the same bytes, preventing it from making progress. The affected worker thread remains busy at 100 % CPU after the timeout expires and after the client disconnects, which leads to a persistent denial of service. Repeated requests can consume all worker threads, forcing a full process restart.

Affected Systems

HAProxy Technologies:HAProxy Kubernetes Ingress Controller, HAProxy Technologies:Kubernetes Ingress Controller Enterprise, HAProxy:HAProxy, and HAProxy:HAProxy Enterprise Edition running HAProxy 3 versions earlier than 3.4.6.

Risk and Exploitability

The CVSS score of 7.5 indicates a moderate‑to‑high severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote HTTP request, with no authentication required. An attacker who can connect to the load balancer can repeatedly issue the malformed chunked requests, exhausting worker threads and interrupting service.

Generated by OpenCVE AI on October 22, 2026 at 05:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade all HAProxy instances to version 3.4.6 or later for all products, including the Kubernetes Ingress Controller.
  • If an upgrade cannot be performed immediately, apply request filtering or rate‑limiting to block malformed HTTP/1.1 chunked requests before they reach HAProxy.
  • Monitor worker thread CPU usage and configure automated alerts or auto‑restarts when sustained high CPU utilization is detected.

Generated by OpenCVE AI on October 22, 2026 at 05:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Haproxy
Haproxy haproxy
Haproxy haproxy Enterprise
Haproxy kubernetes Ingress Controller
Haproxy kubernetes Ingress Controller Enterprise
Vendors & Products Haproxy
Haproxy haproxy
Haproxy haproxy Enterprise
Haproxy kubernetes Ingress Controller
Haproxy kubernetes Ingress Controller Enterprise

Thu, 22 Oct 2026 06:00:00 +0000

Type Values Removed Values Added
Title Remote Denial of Service via HTTP Chunked Request in HAProxy

Thu, 22 Oct 2026 03:00:00 +0000

Type Values Removed Values Added
Description HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
Weaknesses CWE-835
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Haproxy Haproxy Haproxy Enterprise Kubernetes Ingress Controller Kubernetes Ingress Controller Enterprise
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-22T02:46:38.255Z

Reserved: 2026-10-13T23:22:44.319Z

Link: CVE-2026-110354

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-22T03:16:31.427

Modified: 2026-10-22T03:16:31.427

Link: CVE-2026-110354

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T10:39:14Z

Weaknesses
  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')