{"id":"CVE-2026-110354","revision":"fc35f2b641ea45ec928d2a7a9928ac0c","records":[{"revision":"fc35f2b641ea45ec928d2a7a9928ac0c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-110354","aliases":[],"title":"HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream…","description":"HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.","state":0,"publishedAt":"2026-10-22T02:46:38.255+00:00","modifiedAt":"2026-10-22T19:10:34.563+00:00","affected":[{"ecosystem":"Vendor product","name":"HAProxy","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"mux-h1\"\n                    ],\n                    \"product\": \"HAProxy\",\n                    \"programFiles\": [\n                        \"src/h1_htx.c\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"h1_parse_msg_data\"\n                        }\n                    ],\n                    \"repo\": \"https://git.haproxy.org/git/haproxy.git\",\n                    \"vendor\": \"HAProxy\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"3.0.30\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.0.0\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"lessThan\": \"3.2.26\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.2.0\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"lessThan\": \"3.3.17\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.3.0\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"lessThan\": \"3.4.6\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.4.0\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"lessThan\": \"3.5-dev9\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.5-dev\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"HAProxy Enterprise Edition","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"HAProxy Enterprise Edition\",\n                    \"vendor\": \"HAProxy\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"3.0r1-362.1441\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.0r1\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"lessThan\": \"3.2r1-378.1259\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.2r1\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"lessThan\": \"3.3r1-377.1005\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.3r1\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"HAProxy Kubernetes Ingress Controller","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"HAProxy Kubernetes Ingress Controller\",\n                    \"vendor\": \"HAProxy Technologies\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"3.2.17\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.2.0\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Kubernetes Ingress Controller Enterprise","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"Kubernetes Ingress Controller Enterprise\",\n                    \"vendor\": \"HAProxy Technologies\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"3.2.17-ee1\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.2.0\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"lessThan\": \"3.0.16-ee17\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.0\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"lessThan\": \"1.11.14-ee11\",\n                            \"status\": \"affected\",\n                            \"version\": \"1.11\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://git.haproxy.org/?p=haproxy.git;a=commit;h=077906da140a35873bf451d7e9f67646c9f37c81"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110354","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-110354","identifiers":["CVE-2026-110354"]},"retained":false,"historicalAffected":[]}],"coverage":[]}