UBUNTU-CVE-2026-110354: High severity ubuntu/haproxy vulnerability

Q: Which HAProxy deployments are affected?

HAProxy 3 versions before 3.4.6 are affected. The issue is in handling HTTP/1.1 chunked requests.

Q: Does exploitation require authentication or user interaction?

No. A remote attacker can trigger the condition without authentication or user interaction, using a crafted HTTP/1.1 chunked request.

Q: What operational impact should responders expect?

An affected worker thread can remain at 100% CPU even after request timeouts expire and the client disconnects. Repeated requests can exhaust all worker threads and deny service until the HAProxy process is restarted.

Q: How can I identify a likely active attack or affected process state?

Look for HAProxy worker threads persistently consuming 100% CPU after HTTP request timeouts have expired or clients have disconnected. Exhaustion of available worker threads is also an indicator of repeated exploitation attempts.

Q: What can be done if an affected process is already exhausted?

Restarting the HAProxy process restores service after worker-thread exhaustion. Upgrade HAProxy 3 to version 3.4.6 or later to address the affected versions.

Published Oct 22, 2026

Updated

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.

Affected Software

7 affected componentsFixes available

ubuntu/haproxy*

ubuntu/haproxy<2.4.30-0ubuntu0.22.04.3

2.4.30-0ubuntu0.22.04.3

ubuntu/haproxy<2.8.30-0ubuntu0.24.04.2

2.8.30-0ubuntu0.24.04.2

ubuntu/haproxy<3.4.2-1ubuntu4.1

3.4.2-1ubuntu4.1

ubuntu/haproxy<3.2.25-0ubuntu0.26.04.2

3.2.25-0ubuntu0.26.04.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/haproxy to a version that resolves this vulnerability.
Fixed in 2.4.30-0ubuntu0.22.04.3
Upgrade
Upgrade ubuntu/haproxy to a version that resolves this vulnerability.
Fixed in 2.8.30-0ubuntu0.24.04.2
Upgrade
Upgrade ubuntu/haproxy to a version that resolves this vulnerability.
Fixed in 3.4.2-1ubuntu4.1
Upgrade
Upgrade ubuntu/haproxy to a version that resolves this vulnerability.
Fixed in 3.2.25-0ubuntu0.26.04.2

Event History

Oct 22, 2026

CVE Published

via OSV·03:16 AM

Data Sourced

via OSV·03:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which HAProxy deployments are affected?

HAProxy 3 versions before 3.4.6 are affected. The issue is in handling HTTP/1.1 chunked requests.

Does exploitation require authentication or user interaction?

No. A remote attacker can trigger the condition without authentication or user interaction, using a crafted HTTP/1.1 chunked request.

What operational impact should responders expect?

An affected worker thread can remain at 100% CPU even after request timeouts expire and the client disconnects. Repeated requests can exhaust all worker threads and deny service until the HAProxy process is restarted.

How can I identify a likely active attack or affected process state?

Look for HAProxy worker threads persistently consuming 100% CPU after HTTP request timeouts have expired or clients have disconnected. Exhaustion of available worker threads is also an indicator of repeated exploitation attempts.

What can be done if an affected process is already exhausted?

Restarting the HAProxy process restores service after worker-thread exhaustion. Upgrade HAProxy 3 to version 3.4.6 or later to address the affected versions.

UBUNTU-CVE-2026-110354: High severity ubuntu/haproxy vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which HAProxy deployments are affected?

Does exploitation require authentication or user interaction?

What operational impact should responders expect?

How can I identify a likely active attack or affected process state?

What can be done if an affected process is already exhausted?

Company

Resources

Contact

Frequently Asked Questions

Which HAProxy deployments are affected?

Does exploitation require authentication or user interaction?

What operational impact should responders expect?

How can I identify a likely active attack or affected process state?

What can be done if an affected process is already exhausted?