CVE-2026-110354

High

Description

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.

SeverityHigh

CVSS7.5

Exploit probability—

Product

Microsoft Azl3 Haproxy

PublishedOct 22, 2026

First seenOct 22, 2026

Weakness typeCWE-835CWE-835

How to fix

Vendor advisories

git.haproxy.org/?p=haproxy.git;a=commit;h=077906da140a35873bf451d7e9f67646c9f37c81

Affected products

Product	Affected versions	Fixed in
microsoft azl3_haproxy_2.9.11-8	No range specified	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.