CVE-2026-110354: HAProxy 3 Denial of Service Vulnerability

CVE-2026-110354 Overview

CVE-2026-110354 is a denial-of-service vulnerability in HAProxy 3 versions prior to 3.4.6. A remote unauthenticated attacker can trigger persistent worker-thread CPU exhaustion by sending a crafted HTTP/1.1 chunked request. The HTTP/1 (H1) multiplexer drains the request before closing the stream, but the parser repeatedly re-processes the same bytes without making forward progress. The affected worker thread remains pinned at 100% CPU after timeouts expire and after the client disconnects. Repeated requests can consume every worker thread until the HAProxy process is restarted, taking the proxy fleet offline for all downstream services.

Critical Impact
An unauthenticated remote attacker can disable HAProxy worker threads with a single chunked HTTP/1.1 request, and repeat the attack to fully stall the proxy until restart.

Affected Products

HAProxy 3.x prior to 3.4.6
Deployments using the HTTP/1 (H1) multiplexer for inbound HTTP/1.1 traffic
Any environment exposing HAProxy to untrusted HTTP/1.1 clients

Discovery Timeline

2026-10-22 - CVE-2026-110354 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-110354

Vulnerability Analysis

The vulnerability is an infinite loop condition classified under [CWE-835] (Loop with Unreachable Exit Condition). The HAProxy H1 multiplexer handles HTTP/1.1 chunked transfer-encoded request bodies by draining remaining data from the receive buffer before releasing the stream. During this drain path, the chunked parser re-enters processing on the same byte range without advancing its parser state or consuming input. The result is a tight loop inside a worker thread that continues even after request timeouts fire and the client TCP connection closes.

Because HAProxy multiplexes many connections per worker, a single stuck thread degrades a slice of concurrent traffic. An attacker who issues several malformed chunked requests can pin every worker, blocking new connections and preventing legitimate request processing. Only a process restart recovers the data path.

Root Cause

The root cause is a missing forward-progress check in the H1 multiplexer's chunked-body drain routine. The parser is invoked in a loop that assumes each iteration either consumes input, errors out, or completes the message. When the specific chunked request pattern is received during the drain-and-close path, none of those exit conditions is reached, so the loop never terminates. The upstream fix is committed in the HAProxy source tree at commit 077906d.

Attack Vector

Exploitation requires only network reachability to an HAProxy frontend accepting HTTP/1.1. No authentication, no credentials, and no user interaction are needed. The attacker sends an HTTP/1.1 request with Transfer-Encoding: chunked crafted to trigger the non-progressing parse path. The malicious client can disconnect immediately; the worker thread continues looping. Repeating the request across connections exhausts the entire worker pool. Detailed patch context is available in the HAProxy Commit Change.

Detection Methods for CVE-2026-110354

Indicators of Compromise

One or more HAProxy worker threads sustained at 100% CPU after client disconnects and after timeout client or timeout http-request should have fired.
Growing number of stuck threads over time with no corresponding increase in legitimate request volume.
HAProxy stats showing frontend sessions stalled while backend servers remain healthy and idle.

Detection Strategies

Monitor per-thread CPU utilization for HAProxy processes and alert on threads above 95% CPU for longer than the configured client timeout.
Inspect inbound traffic for HTTP/1.1 requests using Transfer-Encoding: chunked with malformed or non-progressing chunk framing from unexpected sources.
Correlate HAProxy worker CPU spikes with short-lived client connections that transmit chunked bodies and disconnect abruptly.

Monitoring Recommendations

Export HAProxy runtime metrics via the Prometheus exporter or show activity on the admin socket and track idle_pct per thread.
Alert on process-level CPU saturation when request rate does not justify the load.
Capture packet traces at the proxy frontend during CPU anomalies to retain chunked request payloads for analysis.

How to Mitigate CVE-2026-110354

Immediate Actions Required

Upgrade HAProxy to version 3.4.6 or later on all affected instances.
Restart any HAProxy process currently showing threads pinned at 100% CPU to restore service capacity.
Restrict exposure of HAProxy frontends to untrusted networks until the patch is deployed.

Patch Information

The fix is included in HAProxy 3.4.6. The upstream source change is published at the HAProxy Commit Change under commit hash 077906da140a35873bf451d7e9f67646c9f37c81. Operators running packaged builds should apply vendor-provided updates once rebuilt against 3.4.6 or backported patches.

Workarounds

Place an upstream HTTP/2-only or sanitizing proxy in front of HAProxy to normalize or reject HTTP/1.1 chunked requests from untrusted clients.
Use a web application firewall rule to block requests combining Transfer-Encoding: chunked with abnormal chunk sizing on exposed frontends.
Tighten timeout client and timeout http-request values; note that this does not stop the loop but reduces concurrent stuck sessions during remediation.