CVE-2026-110354

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110354
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110354.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110354
Downstream
Related
Published
2026-10-22T02:46:38Z
Modified
2026-11-06T17:27:16Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.

Database specific 
{
    "cna_assigner": "mitre",
    "cwe_ids": [
        "CWE-835"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110354.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "3.0.0"
                        },
                        {
                            "fixed": "3.0.30"
                        },
                        {
                            "introduced": "3.2.0"
                        },
                        {
                            "fixed": "3.2.26"
                        },
                        {
                            "introduced": "3.3.0"
                        },
                        {
                            "fixed": "3.3.17"
                        },
                        {
                            "introduced": "3.0r1"
                        },
                        {
                            "fixed": "3.0r1-362.1441"
                        },
                        {
                            "introduced": "3.2r1"
                        },
                        {
                            "fixed": "3.2r1-378.1259"
                        },
                        {
                            "introduced": "3.3r1"
                        },
                        {
                            "fixed": "3.3r1-377.1005"
                        },
                        {
                            "introduced": "3.2.0"
                        },
                        {
                            "fixed": "3.2.17-ee1"
                        },
                        {
                            "introduced": "3.0"
                        },
                        {
                            "fixed": "3.0.16-ee17"
                        },
                        {
                            "introduced": "1.11"
                        },
                        {
                            "fixed": "1.11.14-ee11"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / git.haproxy.org/git/haproxy.git/

Affected ranges

Type
GIT
Repo
https://git.haproxy.org/git/haproxy.git/
Events
Introduced
64a335366dc1bb5431e28a75e3a22e4226ac9b8f
Fixed
fcfabd0d909afaf379a4e30eb43c5229ddbb9d70
Introduced
7835e1fcbe9208d811e9d89b49e259dad97b6e96
Fixed
37f3ad8aa35bb34b2363b73541780df6c7226270
Introduced
e134140d282c006417945d78e7964cc8fa14586a
Fixed
0ac41ff97e11985ec1cc8f87b7e851c308610d9d
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "3.4.0"
                },
                {
                    "fixed": "3.4.6"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "3.5-dev"
                },
                {
                    "fixed": "3.5-dev9"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "3.2.0"
                },
                {
                    "fixed": "3.2.17"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

v3.*
v3.2.0
v3.3-dev0
v3.3-dev1
v3.3-dev10
v3.3-dev11
v3.3-dev12
v3.3-dev13
v3.3-dev14
v3.3-dev2
v3.3-dev3
v3.3-dev4
v3.3-dev5
v3.3-dev6
v3.3-dev7
v3.3-dev8
v3.3-dev9
v3.3.0
v3.4-dev0
v3.4-dev1
v3.4-dev2
v3.4-dev3
v3.4-dev4
v3.4-dev5
v3.5-dev0
v3.5-dev1
v3.5-dev2
v3.5-dev3
v3.5-dev4
v3.5-dev5
v3.5-dev6
v3.5-dev7
v3.5-dev8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110354.json"