DEBIAN-CVE-2026-110354
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-110354
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-110354.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-110354
- Upstream
- CVE-2026-110354
- Published
- 2026-10-22T03:16:31Z
- Modified
- 2026-10-26T08:00:08Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
- References
Affected packages
Debian:12 / haproxy
Package
- Name
- haproxy
- Purl
- pkg:deb/debian/haproxy?arch=source&distro=bookworm
Debian:13 / haproxy
Package
- Name
- haproxy
- Purl
- pkg:deb/debian/haproxy?arch=source&distro=trixie
Debian:14 / haproxy
Package
- Name
- haproxy
- Purl
- pkg:deb/debian/haproxy?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed3.2.26-1
Affected versions
3.*
3.0.11-1
3.1.0-1
3.1.0-2
3.1.1-1
3.1.2-1
3.1.3-1
3.1.5-1
3.1.6-1
3.1.7-1
3.2.0-1
3.2.1-1
3.2.3-1
3.2.3-2
3.2.4-1
3.2.5-1
3.2.5-2
3.2.6-1
3.2.7-1
3.2.8-1
3.2.9-1
3.2.10-1
3.2.11-1
3.2.11-2
3.2.12-1
3.2.13-1
3.2.14-1
3.2.15-1
3.2.16-1
3.2.17-1
3.2.18-1
3.2.19-1
3.2.20-1
3.2.21-1
3.2.22-1
3.2.23-1
3.2.24-1
3.2.25-1