CVE-2026-110354 in HAProxy
Summary
by MITRE • 10/22/2026
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in HAProxy versions prior to 3.4.6 represents a critical denial of service condition stemming from an inefficient handling of HTTP/1.1 chunked transfer encoding within the protocol parser. This flaw allows remote, unauthenticated attackers to trigger persistent worker-thread CPU exhaustion by crafting specific malicious requests. The core technical issue lies in the interaction between the HAProxy H1 multiplexer and its underlying parsing logic. While the multiplexer is designed to drain request bodies before closing connections to ensure proper stream management, the parser fails to make forward progress when processing certain malformed or edge-case chunked payloads. Instead of advancing through the data buffer, the parser enters a state where it repeatedly re-processes the same bytes without consuming them effectively. This creates an infinite loop scenario at the application layer that consumes significant computational resources.
The operational impact of this vulnerability is severe due to the architecture of HAProxy as a high-performance load balancer and proxy server. Each incoming connection typically occupies a dedicated worker thread, which are finite system resources. When an attacker sends requests containing the specific chunked encoding pattern that triggers this bug, the affected worker thread becomes stuck in a tight loop at one hundred percent CPU utilization. Crucially, this state persists even after network timeouts expire and the client disconnects from the server. The thread does not release its hold on the processor or return to an idle state as expected under normal failure conditions. Consequently, if multiple such requests are sent concurrently, they can exhaust all available worker threads in the HAProxy process pool. Once these resources are depleted, the proxy becomes unable to accept new legitimate connections, resulting in a complete service outage for downstream applications relying on this frontend infrastructure.
This vulnerability aligns with CWE-400, which describes uncontrolled resource consumption leading to denial of service conditions. Furthermore, from an offensive security perspective, it maps directly to MITRE ATT&CK technique T1499, specifically Endpoint Denial of Service via application layer exhaustion attacks. The attack vector is particularly dangerous because it requires no authentication and can be executed remotely over standard HTTP traffic, making it difficult to detect using traditional signature-based intrusion detection systems that do not inspect the internal state machine behavior of the proxy parser.
Mitigation strategies must focus on immediate version upgrades and temporary configuration hardening until patching is complete. The primary remediation step is to upgrade HAProxy to version 3.4.6 or later, where this parsing logic has been corrected to ensure proper progress during chunked body processing. For environments where an immediate upgrade is not feasible, administrators should consider implementing rate limiting on incoming connections to mitigate the volume of requests that can be processed simultaneously. Additionally, deploying a Web Application Firewall in front of HAProxy with strict rules for HTTP/1.1 chunked encoding validation may help filter out malformed payloads before they reach the vulnerable parser. Monitoring worker thread CPU usage and connection counts via monitoring tools like Prometheus or Grafana is also recommended to detect potential exploitation attempts early through anomalous resource consumption patterns.