{"id":"AZL-111017","summary":"CVE-2026-110354 affecting package haproxy 2.9.11-8","details":"HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.","modified":"2026-10-28T05:32:34Z","published":"2026-10-22T03:16:31Z","upstream":["CVE-2026-110354"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110354"}],"affected":[{"package":{"name":"haproxy","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/haproxy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.9.11-8"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-111017.json"}}],"schema_version":"1.9.2"}