CVE-2026-110354: High severity HAProxy HAProxy vulnerability
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
HAProxy versions before 3.4.6 are affected when they process HTTP/1.1 chunked requests. The issue can be triggered remotely without authentication.
What does an attacker need to do to cause impact?
An attacker needs only to send a crafted HTTP/1.1 chunked request. No credentials or user interaction are required, and repeated requests can exhaust all worker threads.
What happens after the malicious client disconnects?
The affected worker thread can remain at 100% CPU even after request timeouts expire and the client disconnects. This persistent exhaustion continues until the HAProxy process is restarted.
How can I tell whether an instance may already be under attack?
A likely indicator is one or more HAProxy worker threads remaining at 100% CPU after client connections have closed or timed out. If repeated requests exhaust available worker threads, service may become unavailable until HAProxy is restarted.
What can be done if an affected process is already exhausted?
Restarting the HAProxy process clears the persistent worker-thread CPU exhaustion. To address the underlying issue, move to version 3.4.6 or later.