Live › vulnerability › CVE-2026-110354
Go to dashboardHAProxy 3 before 3.4.6 has a parser flaw that re-processes the same bytes of an HTTP/1.1 chunked request without progress. A remote unauthenticated attacker can keep worker threads busy at full CPU, and repeated requests can exhaust all workers until the process restarts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any HAProxy 3 deployment before 3.4.6 that accepts HTTP/1.1 traffic from untrusted clients is exposed, since the flaw is reached through an ordinary chunked request. Teams running HAProxy 2.x or a version at or above 3.4.6 are not affected by this entry. Internal-only proxies that only see trusted clients have lower exposure but should still be patched.
No product ranges from the sources yet.
haproxy -v and compare the version against 3.4.6.3.4.6.3.4.6 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
This page as .md · .json · in your agent: get_signal("CVE-2026-110354")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.