---
id: "CVE-2026-110354"
kind: "vulnerability"
aliases: ["CVE-2026-110354"]
title: "HAProxy 3: crafted chunked request pins worker threads at 100% CPU"
severity: "high"
cvss: 7.5
epss: 0.00762
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["haproxy", "http", "infrastructure", "load-balancer", "self-hosted"]
not_affected_if: ["haproxy-2-or-earlier", "internal-only-clients", "version-3.4.6-or-later"]
published_at: "2026-10-22T03:16:31+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:16:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110354", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-110354", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# HAProxy 3: crafted chunked request pins worker threads at 100% CPU

HAProxy 3 before 3.4.6 has a parser flaw that re-processes the same bytes of an HTTP/1.1 chunked request without progress. A remote unauthenticated attacker can keep worker threads busy at full CPU, and repeated requests can exhaust all workers until the process restarts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `haproxy -v` and compare the version against `3.4.6`.
- Check that the installed HAProxy is a 3.x release before `3.4.6`.

## Fix

- Upgrade HAProxy 3.x to `3.4.6` or later.
- Restart HAProxy after the upgrade so the fixed binary is loaded.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110354
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-110354

## From the sources

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_