CVE-2026-110354
HIGH 7.5HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
Severe if exploited (CVSS 7.5), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.8%chance of exploitation in 30 days · 57th percentile
Impact if exploited
7.5CVSS 3.1 · HIGH
- ConfidentialityNone
- IntegrityNone
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Affected
Vendors Haproxy Haproxy Technologies
Products Haproxy Haproxy Enterprise Edition Haproxy Kubernetes Ingress Controller Kubernetes Ingress Controller Enterprise
Weakness (CWE)
- CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References and research data (JSON)
Vendor product assessments
haproxy.src as a component of Red Hat Ceph Storage 5 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/haproxy?arch=src
- none available: Fix deferred
haproxy22 as a component of Red Hat Ceph Storage 5 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/haproxy22
- none available: Fix deferred
haproxy as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/haproxy
- none available: Affected
haproxy.src as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/haproxy?arch=src
- none available: Affected
haproxy as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/haproxy
- none available: Affected
haproxy.src as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/haproxy?arch=src
- none available: Affected
haproxy as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/haproxy
- none available: Affected
haproxy.src as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/haproxy?arch=src
- none available: Affected
haproxy as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/haproxy
- none available: Affected
haproxy.src as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/haproxy?arch=src
- none available: Affected
haproxy.src as a component of Red Hat Hardened Images · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/haproxy?arch=src
- none available: Affected
haproxy.src as a component of Red Hat OpenShift Container Platform 4 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/haproxy?arch=src
- none available: Affected
haproxy18 as a component of Red Hat OpenShift Container Platform 4 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/haproxy18
- none available: Affected
haproxy20 as a component of Red Hat OpenShift Container Platform 4 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/haproxy20
- none available: Affected
haproxy22 as a component of Red Hat OpenShift Container Platform 4 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/haproxy22
- none available: Affected
haproxy26 as a component of Red Hat OpenShift Container Platform 4 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/haproxy26
- none available: Affected
haproxy28 as a component of Red Hat OpenShift Container Platform 4 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/haproxy28
- none available: Affected
All CVSS metrics
- HIGH 7.5 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - HIGH 7.5 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Advisories
- https://git.haproxy.org/?p=haproxy.git;a=commit;h=077906da140a35873bf451d7e9f67646c9f37c81 CVE record · mitre · Updated 2026-10-22T02:46:38.255Z
NVD · CVE-2026-110354 · Updated 2026-10-22T19:17:35.660
Red Hat · CVE-2026-110354 · Updated 2026-10-22T10:18:11+00:00 - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-110354.json Red Hat · CVE-2026-110354 · Updated 2026-10-22T10:18:11+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108000 EUVD · EUVD-2026-108000
Technical & other
- https://access.redhat.com/security/cve/CVE-2026-110354 Red Hat · CVE-2026-110354 · Updated 2026-10-22T10:18:11+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2558749 Red Hat · CVE-2026-110354 · Updated 2026-10-22T10:18:11+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-110354 Red Hat · CVE-2026-110354 · Updated 2026-10-22T10:18:11+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-110354 Red Hat · CVE-2026-110354 · Updated 2026-10-22T10:18:11+00:00