Vulnerability · Published Oct 22, 2026 · Assigned by mitre
CVE-2026-110354
High 7.5
In plain English
A high-severity infinite loop in HAProxy from HAProxy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | haproxy | 2.6.12-1+deb12u4 | DEBIAN-CVE-2026-110354 |
| Debian:13 | haproxy | 3.0.11-1+deb13u4 | DEBIAN-CVE-2026-110354 |
| Debian:14 | haproxy | 3.2.26-1 | DEBIAN-CVE-2026-110354 |
| Ubuntu:22.04:LTS | haproxy | 2.4.30-0ubuntu0.22.04.3 | USN-8972-1 |
| Ubuntu:22.04:LTS | haproxy | 2.4.30-0ubuntu0.22.04.3 | UBUNTU-CVE-2026-110354 |
| Ubuntu:24.04:LTS | haproxy | 2.8.30-0ubuntu0.24.04.2 | UBUNTU-CVE-2026-110354 |
| Ubuntu:24.04:LTS | haproxy | 2.8.30-0ubuntu0.24.04.2 | USN-8972-1 |
| Ubuntu:26.04:LTS | haproxy | 3.2.25-0ubuntu0.26.04.2 | UBUNTU-CVE-2026-110354 |
| Ubuntu:26.04:LTS | haproxy | 3.2.25-0ubuntu0.26.04.2 | USN-8972-1 |
| Ubuntu:26.10 | haproxy | 3.4.2-1ubuntu4.1 | UBUNTU-CVE-2026-110354 |
| Ubuntu:26.10 | haproxy | 3.4.2-1ubuntu4.1 | USN-8972-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HAProxy | HAProxy | 3.0.0 – before 3.0.303.2.0 – before 3.2.263.3.0 – before 3.3.173.4.0 – before 3.4.63.5-dev – before 3.5-dev9 |
| HAProxy | HAProxy Enterprise Edition | 3.0r1 – before 3.0r1-362.14413.2r1 – before 3.2r1-378.12593.3r1 – before 3.3r1-377.1005 |
| HAProxy Technologies | HAProxy Kubernetes Ingress Controller | 3.2.0 – before 3.2.17 |
| HAProxy Technologies | Kubernetes Ingress Controller Enterprise | 3.2.0 – before 3.2.17-ee13.0 – before 3.0.16-ee171.11 – before 1.11.14-ee11 |
Weakness: CWE-835 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H