CVEs / CVE-2026-110354
CVE-2026-110354: HAProxy HAProxy vulnerability
- high 7.5 CVSS 3.1 (from the CNA)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2026-110354
Description
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| HAProxy HAProxy | from 3.0.0, before 3.0.30 | 3.0.30 |
| HAProxy HAProxy | from 3.2.0, before 3.2.26 | 3.2.26 |
| HAProxy HAProxy | from 3.3.0, before 3.3.17 | 3.3.17 |
| HAProxy HAProxy | from 3.4.0, before 3.4.6 | 3.4.6 |
| HAProxy HAProxy | from 3.5-dev, before 3.5-dev9 | 3.5-dev9 |
| HAProxy HAProxy Enterprise Edition | from 3.0r1, before 3.0r1-362.1441 | 3.0r1-362.1441 |
| HAProxy HAProxy Enterprise Edition | from 3.2r1, before 3.2r1-378.1259 | 3.2r1-378.1259 |
| HAProxy HAProxy Enterprise Edition | from 3.3r1, before 3.3r1-377.1005 | 3.3r1-377.1005 |
| HAProxy Technologies HAProxy Kubernetes Ingress Controller | from 3.2.0, before 3.2.17 | 3.2.17 |
| HAProxy Technologies Kubernetes Ingress Controller Enterprise | from 3.2.0, before 3.2.17-ee1 | 3.2.17-ee1 |
| HAProxy Technologies Kubernetes Ingress Controller Enterprise | from 3.0, before 3.0.16-ee17 | 3.0.16-ee17 |
| HAProxy Technologies Kubernetes Ingress Controller Enterprise | from 1.11, before 1.11.14-ee11 | 1.11.14-ee11 |
Exploitation
Not in the CISA Known Exploited Vulnerabilities catalog as of 4 Nov 2026.
Severity
| CVSS 3.1 | 7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HScored by the CNA ([email protected]) |
|---|---|
| Weakness | CWE-835 |
On the Stackurity blog
References
- CVE-2026-110354 on NVD
- CVE-2026-110354 on OSV
- https://git.haproxy.org/?p=haproxy.git;a=commit;h=077906da140a35873bf451d7e9f67646c9f37c81
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.