{"id":"CVE-2026-110354","kind":"vulnerability","aliases":["CVE-2026-110354"],"related":[],"title":"HAProxy 3: crafted chunked request pins worker threads at 100% CPU","description":"HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.","summary":"HAProxy 3 before 3.4.6 has a parser flaw that re-processes the same bytes of an HTTP/1.1 chunked request without progress. A remote unauthenticated attacker can keep worker threads busy at full CPU, and repeated requests can exhaust all workers until the process restarts.","severity":"high","cvss":7.5,"epss":0.00762,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["haproxy","http","infrastructure","load-balancer","self-hosted"],"not_affected_if":["haproxy-2-or-earlier","internal-only-clients","version-3.4.6-or-later"],"how_to_check":"- Run `haproxy -v` and compare the version against `3.4.6`.\n- Check that the installed HAProxy is a 3.x release before `3.4.6`.","fix":"- Upgrade HAProxy 3.x to `3.4.6` or later.\n- Restart HAProxy after the upgrade so the fixed binary is loaded.","status":"open","published_at":"2026-10-22T03:16:31+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:16:14+00:00","updated_at":"2026-10-25T03:16:14+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T03:16:14Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade HAProxy 3.x to `3.4.6` or later.\n- Restart HAProxy after the upgrade so the fixed binary is loaded.","reach":"internet","title":"HAProxy 3: crafted chunked request pins worker threads at 100% CPU","impact":"medium","summary":"HAProxy 3 before 3.4.6 has a parser flaw that re-processes the same bytes of an HTTP/1.1 chunked request without progress. A remote unauthenticated attacker can keep worker threads busy at full CPU, and repeated requests can exhaust all workers until the process restarts.","category":"infrastructure","nicknames":[],"who_cares":["haproxy","self-hosted","load-balancer","http"],"confidence":0.7,"needs_auth":"no","worst_case":"Worker threads stuck at full CPU until the HAProxy process restarts","analyst_note":"","how_to_check":"- Run `haproxy -v` and compare the version against `3.4.6`.\n- Check that the installed HAProxy is a 3.x release before `3.4.6`.","needs_analyst":false,"not_affected_if":["haproxy-2-or-earlier","version-3.4.6-or-later","internal-only-clients"],"who_is_affected":"Any HAProxy 3 deployment before 3.4.6 that accepts HTTP/1.1 traffic from untrusted clients is exposed, since the flaw is reached through an ordinary chunked request. Teams running HAProxy 2.x or a version at or above 3.4.6 are not affected by this entry. Internal-only proxies that only see trusted clients have lower exposure but should still be patched.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000647,"input_tokens":3432,"output_tokens":607,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110354':14A,17A '-2026':13A,16A '100':10A,127C '3':2A,28B,73C '3.4.6':30B,75C 'affect':122C 'allow':76C 'although':98C 'attack':52B,80C 'balanc':23B 'busi':57B,125C 'byte':41B,117C 'caus':82C 'chunk':4A,45B,96C 'client':135C 'close':106C 'consum':141C 'cpu':11A,60B,91C,128C 'craft':3A 'cve':12A,15A 'denial':84C 'disconnect':136C 'drain':102C 'exhaust':65B,92C 'expir':131C 'flaw':34B 'full':59B 'h1':100C 'haproxi':1A,18B,27B,72C 'host':26B 'http':19B 'http/1.1':44B,95C 'infrastructur':20B 'keep':54B 'load':22B 'load-balanc':21B 'make':119C 'multiplex':101C 'parser':33B,110C 'persist':87C 'pin':6A 'process':38B,70B,114C,147C 'progress':48B,120C 're':37B,113C 're-process':36B,112C 'remot':50B,78C 'repeat':62B,111C,138C 'request':5A,46B,63B,97C,104C,139C 'restart':71B,149C 'self':25B 'self-host':24B 'servic':86C 'stay':124C 'stream':108C 'thread':8A,56B,90C,123C,144C 'timeout':130C 'unauthent':51B,79C 'via':93C 'without':47B,118C 'worker':7A,55B,67B,89C,143C 'worker-thread':88C","nicknames":[],"mitigations":[],"who_affected":"Any HAProxy 3 deployment before 3.4.6 that accepts HTTP/1.1 traffic from untrusted clients is exposed, since the flaw is reached through an ordinary chunked request. Teams running HAProxy 2.x or a version at or above 3.4.6 are not affected by this entry. Internal-only proxies that only see trusted clients have lower exposure but should still be patched.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T03:16:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110354","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110354","severity":null,"published_at":"2026-10-22T03:16:31+00:00","modified_at":"2026-10-22T19:17:35+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-110354","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110354","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}