{"id":"CVE-2026-110354","details":"HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.","modified":"2026-11-06T17:27:16.187243403Z","published":"2026-10-22T02:46:38.255Z","related":["openSUSE-SU-2026:12431-1"],"database_specific":{"cwe_ids":["CWE-835"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110354.json","unresolved_ranges":[{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"3.0.0"},{"fixed":"3.0.30"},{"introduced":"3.2.0"},{"fixed":"3.2.26"},{"introduced":"3.3.0"},{"fixed":"3.3.17"},{"introduced":"3.0r1"},{"fixed":"3.0r1-362.1441"},{"introduced":"3.2r1"},{"fixed":"3.2r1-378.1259"},{"introduced":"3.3r1"},{"fixed":"3.3r1-377.1005"},{"introduced":"3.2.0"},{"fixed":"3.2.17-ee1"},{"introduced":"3.0"},{"fixed":"3.0.16-ee17"},{"introduced":"1.11"},{"fixed":"1.11.14-ee11"}]}]}],"cna_assigner":"mitre"},"references":[{"type":"ADVISORY","url":"https://git.haproxy.org/?p=haproxy.git;a=commit;h=077906da140a35873bf451d7e9f67646c9f37c81"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110354.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110354"},{"type":"PACKAGE","url":"https://git.haproxy.org/git/haproxy.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.haproxy.org/git/haproxy.git/","events":[{"introduced":"64a335366dc1bb5431e28a75e3a22e4226ac9b8f"},{"fixed":"fcfabd0d909afaf379a4e30eb43c5229ddbb9d70"},{"introduced":"7835e1fcbe9208d811e9d89b49e259dad97b6e96"},{"fixed":"37f3ad8aa35bb34b2363b73541780df6c7226270"},{"introduced":"e134140d282c006417945d78e7964cc8fa14586a"},{"fixed":"0ac41ff97e11985ec1cc8f87b7e851c308610d9d"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"3.4.0"},{"fixed":"3.4.6"}]},{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"3.5-dev"},{"fixed":"3.5-dev9"}]},{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"3.2.0"},{"fixed":"3.2.17"}]}]}}],"versions":["v3.5-dev8","v3.5-dev7","v3.5-dev6","v3.5-dev5","v3.5-dev4","v3.5-dev3","v3.5-dev2","v3.5-dev1","v3.5-dev0","v3.4-dev5","v3.4-dev4","v3.4-dev3","v3.4-dev2","v3.4-dev1","v3.4-dev0","v3.3.0","v3.3-dev14","v3.3-dev13","v3.3-dev12","v3.3-dev11","v3.3-dev10","v3.3-dev9","v3.3-dev8","v3.3-dev7","v3.3-dev6","v3.3-dev5","v3.3-dev4","v3.3-dev3","v3.3-dev2","v3.3-dev1","v3.3-dev0","v3.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110354.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}