AZL-111017
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-111017.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-111017
- Upstream
- CVE-2026-110354
- Published
- 2026-10-22T03:16:31Z
- Modified
- 2026-10-28T05:32:34Z
- Summary
- CVE-2026-110354 affecting package haproxy 2.9.11-8
- Details
-
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
- References