high CVSS 7.5 EPSS 0.76%

CVE-2026-110354·HAProxy vulnerability

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.

Severity
high
Software
HAProxy
Fixed in
3.4.6
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.76% — higher than 55% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-110354 scores 7.5 on CVSS, so a successful attack would be serious — but at 0.76%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

Until: 2.6.12-1+deb12u4

Fixed in: 3.4.6

How to fix this CVE

Upgrade HAProxy to version 3.4.6 or later to patch a critical denial-of-service vulnerability in HTTP/1.1 chunked request handling. This vulnerability causes worker threads to enter an infinite parsing loop, consuming 100% CPU and eventually exhausting all available workers. Organizations running HAProxy 3.x should prioritize this update to maintain service availability.

sudo dnf update haproxy

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET|HEAD|PUT|DELETE|PATCH|OPTIONS|TRACE|CONNECT /.*HTTP/1\.1.*\r\nTransfer-Encoding:\s*chunked.*\r\n[0-9a-fA-F]{0,3}[\r\n]{1,2}[\x00-\x08\x0b-\x0c\x0e-\x1f\x7f]*

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Implement rate limiting on malformed or incomplete chunked Transfer-Encoding requests; reject HTTP/1.1 requests with invalid chunk size declarations; configure timeouts to aggressively close connections showing slow-loris patterns or repeated chunk parsing anomalies.

How to check if you are affected

  1. Step 1: Check HAProxy version with `haproxy -v` and compare against 3.4.6; versions below this are vulnerable
  2. Step 2: Verify HAProxy is actively listening for HTTP/1.1 traffic using `netstat -tlnp | grep haproxy` or `ss -tlnp | grep haproxy`
  3. Step 3: Monitor worker thread CPU usage with `top -p $(pidof haproxy)` and observe if any threads spike to 100% CPU after receiving requests
  4. Step 4: After upgrading, confirm the new version with `haproxy -v` and restart the service with `sudo systemctl restart haproxy`

FAQ

What is CVE-2026-110354?

CVE-2026-110354 is a high-severity denial-of-service vulnerability in HAProxy's HTTP/1.1 parser that causes worker threads to repeatedly process malformed chunked requests without progress, resulting in permanent 100% CPU consumption and eventual thread exhaustion.

Is CVE-2026-110354 being actively exploited?

No, CVE-2026-110354 is not currently listed in CISA's Known Exploited Vulnerabilities catalog, and no public exploits are available. However, the vulnerability is trivial to trigger and organizations should not delay patching.

What versions of HAProxy are affected by CVE-2026-110354?

HAProxy 3.x versions prior to 3.4.6 are affected. HAProxy 2.x and earlier versions are not vulnerable to this specific issue.

How do I check if my server is vulnerable to CVE-2026-110354?

Run `haproxy -v` and check the version number. If it reports a version below 3.4.6, your deployment is vulnerable.

Does Defensia detect CVE-2026-110354?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If HAProxy is installed on a monitored server, CVE-2026-110354 will appear in your dashboard with remediation steps.

Related HAProxy CVEs

CVE-2026-55203CVSS 7.5HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.
CVE-2026-55204CVSS 7.5HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.
CVE-2026-110353CVSS 7.5HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.
CVE-2026-26081CVSS 4.8HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-110354. Free for 1 server.

Get started free