---
id: CVE-2026-110354
title: >-
  HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a
  denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1
  chunked request
summary: >-
  HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a
  denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1
  chunked request. Although the H1 multiplexer drains the request before closing
  the str…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-835
vendor: HAProxy
product: HAProxy
affected:
  - HAProxy >= 3.0.0 < 3.0.30
  - HAProxy >= 3.2.0 < 3.2.26
  - HAProxy >= 3.3.0 < 3.3.17
  - HAProxy >= 3.4.0 < 3.4.6
  - HAProxy >= 3.5-dev < 3.5-dev9
  - enterprise_edition >= 3.0r1 < 3.0r1-362.1441
  - enterprise_edition >= 3.2r1 < 3.2r1-378.1259
  - enterprise_edition >= 3.3r1 < 3.3r1-377.1005
  - haproxy_kubernetes_ingress_controller >= 3.2.0 < 3.2.17
  - kubernetes_ingress_controller_enterprise >= 3.2.0 < 3.2.17-ee1
  - kubernetes_ingress_controller_enterprise >= 3.0 < 3.0.16-ee17
  - kubernetes_ingress_controller_enterprise >= 1.11 < 1.11.14-ee11
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T02:46:38.255Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110354'
references:
  - url: >-
      https://git.haproxy.org/?p=haproxy.git;a=commit;h=077906da140a35873bf451d7e9f67646c9f37c81
tags:
  - cve.org
ingestedAt: '2026-10-22T03:25:15.658Z'
---

## Overview

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.

## Affected

- `HAProxy >= 3.0.0 < 3.0.30`
- `HAProxy >= 3.2.0 < 3.2.26`
- `HAProxy >= 3.3.0 < 3.3.17`
- `HAProxy >= 3.4.0 < 3.4.6`
- `HAProxy >= 3.5-dev < 3.5-dev9`
- `enterprise_edition >= 3.0r1 < 3.0r1-362.1441`
- `enterprise_edition >= 3.2r1 < 3.2r1-378.1259`
- `enterprise_edition >= 3.3r1 < 3.3r1-377.1005`
- `haproxy_kubernetes_ingress_controller >= 3.2.0 < 3.2.17`
- `kubernetes_ingress_controller_enterprise >= 3.2.0 < 3.2.17-ee1`
- `kubernetes_ingress_controller_enterprise >= 3.0 < 3.0.16-ee17`
- `kubernetes_ingress_controller_enterprise >= 1.11 < 1.11.14-ee11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.