CVE-2026-110354
Last modified
CVE-2026-110354 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. EPSS estimates a 0.76% chance of exploitation in the next 30 days.
Description
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| HAProxy | HAProxy | >= 3.0.0, < 3.0.30; >= 3.2.0, < 3.2.26; >= 3.3.0, < 3.3.17; >= 3.4.0, < 3.4.6; >= 3.5-dev, < 3.5-dev9 |
| HAProxy | HAProxy Enterprise Edition | >= 3.0r1, < 3.0r1-362.1441; >= 3.2r1, < 3.2r1-378.1259; >= 3.3r1, < 3.3r1-377.1005 |
| HAProxy Technologies | HAProxy Kubernetes Ingress Controller | >= 3.2.0, < 3.2.17 |
| HAProxy Technologies | Kubernetes Ingress Controller Enterprise | >= 3.2.0, < 3.2.17-ee1; >= 3.0, < 3.0.16-ee17; >= 1.11, < 1.11.14-ee11 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-110354?
How severe is CVE-2026-110354?
How do I fix CVE-2026-110354?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-110322The PEAK-System PCAN type 0x4030 processing path fails to va…5.5
- CVE-2026-110324The visibility check of Gitea user profiles was applied to G…6.5
- CVE-2026-11033Uninitialized Use in WebML in Google Chrome on Mac prior to …6.5
- CVE-2026-11034Insufficient validation of untrusted input in Tab Group Sync…6.1
- CVE-2026-11035Inappropriate implementation in Custom Tabs in Google Chrome…7.3
- CVE-2026-110353HAProxy 3.2 before 3.4.6 allows a remote unauthenticated att…7.5
- CVE-2026-110359Hyland Desktop Host for Windows before 25.1.1 is vulnerable …7.8
- CVE-2026-11036Inappropriate implementation in DOM in Google Chrome prior t…6.5
- CVE-2026-110360Missing Authorization vulnerability in WPdreams Ajax Search …5.3
- CVE-2026-110361Insertion of Sensitive Information Into Sent Data vulnerabil…6.5
- CVE-2026-110362Missing Authorization vulnerability in Planet studio PlanetS…5.3
- CVE-2026-110363Missing Authorization vulnerability in ThimPress LearnPress …5.4
Are you affected by CVE-2026-110354?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST